Description
Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filter controls by wrapping SQL keywords in parentheses to perform UNION-based injection and extract sensitive data including administrator credential hashes from the database. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-07-28.
Published: 2026-09-18
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Critical Data Exposure
Action: Patch Immediately
AI Analysis

Impact

Weaver E‑cology contains an unauthenticated SQL injection flaw in the userIdentifiers GET parameter of the SyncUserInfo.jsp endpoint. Attackers can craft input that uses parentheses to bypass the application’s space‑based filtering and perform UNION‑based injection to execute arbitrary SQL queries. This allows direct exposure of sensitive data, including administrator credential hashes, and potentially other database contents.

Affected Systems

The affected vendor is Weaver Network Co., Ltd. and the product is E‑cology. No specific version information is provided in the advisory.

Risk and Exploitability

The flaw has a CVSS score of 8.7, indicating high severity. An EPSS score is not available and the vulnerability is not listed in CISA KEV. Because the injection is unauthenticated and targets a mobile plugin endpoint that is reachable over the network, attackers can easily send HTTP GET requests to exploit it. The vulnerability was actively observed in 2022, confirming that it can be leveraged in the wild.

Generated by OpenCVE AI on September 19, 2026 at 11:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Obtain and install the latest vendor patch for Weaver E‑cology that fixes the SQL injection issue.
  • Restrict or disable unauthenticated access to the SyncUserInfo.jsp endpoint, requiring proper authentication and authorization before processing requests.
  • Deploy web application firewall rules that detect and block SQL injection patterns, especially those that wrap keywords in parentheses to evade simple filters.

Generated by OpenCVE AI on September 19, 2026 at 11:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 21 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Weaver
Weaver e-cology
Vendors & Products Weaver
Weaver e-cology

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filter controls by wrapping SQL keywords in parentheses to perform UNION-based injection and extract sensitive data including administrator credential hashes from the database. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-07-28.
Title Weaver E-cology SQL Injection via SyncUserInfo.jsp
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Weaver E-cology
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-22T15:21:17.416Z

Reserved: 2026-09-18T17:11:05.756Z

Link: CVE-2019-25776

cve-icon Vulnrichment

Updated: 2026-09-22T15:21:10.006Z

cve-icon NVD

Status : Deferred

Published: 2026-09-18T19:16:39.420

Modified: 2026-09-22T20:43:58.793

Link: CVE-2019-25776

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T10:03:53Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')