CVE-2022-50997 Weaver Network Co., Ltd. CVE debrief

Who should care

Defenders responsible for Weaver (Fanwei) E-cology installations should assess exposure and potential impact. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure, assess impact, and apply patches or mitigations.

Why it matters

CVE-2022-50997 is a SQL injection vulnerability in Weaver (Fanwei) E-cology 8.0 and 9.0 that allows unauthenticated remote attackers to extract arbitrary data from the backend database.

• Verify exposure to potential SQL injection attacks.
• Assess potential impact on backend database confidentiality.
• Implement patches or updates to remediate the vulnerability.
• Monitor for potential exploitation attempts.

Technical summary

The CVE record and NVD entry describe a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint of Weaver (Fanwei) E-cology 8.0 and 9.0. This vulnerability allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. The vulnerability is potentially remediated in software version 10.53 or 10.54. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC). Defenders should prioritize verifying exposure and assessing potential impact.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact.

Recommended defensive actions

• Verify exposure by checking if the HrmCareerApplyPerView.jsp endpoint is accessible and if the id parameter is vulnerable to SQL injection.
• Assess potential impact by determining if the backend database contains sensitive data.
• Apply patches or updates to remediate the vulnerability, if available.
• Monitor for potential exploitation attempts and implement compensating controls if necessary.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the SQL injection vulnerability in Weaver (Fanwei) E-cology 8.0 and 9.0. The vulnerability is in the HrmCareerApplyPerView.jsp endpoint and allows unauthenticated remote attackers to extract arbitrary data from the backend database. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.