The vulnerability is a classic SQL injection in the SignatureDownLoad servlet. The markId parameter is concatenated directly into a SQL query without sanitization. By injecting a UNION SELECT payload, an attacker can return an arbitrary filesystem path via the markPath field, causing the servlet to read and stream back files that the application server process can access. As a result, sensitive configuration files, including database credentials, are exposed.

Affected systems are installations of Weaver Network Co., Ltd.’s E‑cology version 8.0. No other versions were explicitly listed. The vendor has indicated that the issue has been remediated in later releases, though the exact version that fixes the flaw is not publicly documented.

The CVSS score is 8.7, indicating a high severity. The EPSS score is below 1 %, suggesting that exploitation is unlikely but still possible; the vulnerability was actively exploited in 2023 according to Shadowserver data. The attack can be carried out fully remotely and by unauthenticated users over HTTP, so the risk to confidentiality is significant. The flaw is listed as CWE‑89 (Improper Input Sanitization).