CVE-2025-34038

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-34038
A SQL injection vulnerability exists in Fanwei e-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://vulncheck.com/advisories/fanwei-ecology-sql-injection Exploit Third Party Advisory
https://www.cnblogs.com/0day-li/p/14637680.html Exploit
https://www.cnvd.org.cn/flaw/show/CNVD-2021-33202 Third Party Advisory
https://www.weaver.com.cn/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:weaver:e-cology:*:*:*:*:*:*:*:*
History

20 Nov 2025, 22:15

Type Values Removed Values Added
Summary (en) A SQL injection vulnerability exists in Fanwei e-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. Exploitation evidence was observed by the Shadowserver Foundation on 2025-07-13 UTC. (en) A SQL injection vulnerability exists in Fanwei e-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

17 Nov 2025, 22:15

Type Values Removed Values Added
Summary (en) A SQL injection vulnerability exists in Fanwei e-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. (en) A SQL injection vulnerability exists in Fanwei e-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. Exploitation evidence was observed by the Shadowserver Foundation on 2025-07-13 UTC.
Information

Published : 2025-06-24 02:15

Updated : 2025-11-20 22:15

NVD link : CVE-2025-34038

Mitre link : CVE-2025-34038

CVE.ORG link : CVE-2025-34038

JSON object : View

Products Affected

weaver

  • e-cology
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')