CVE-2022-50997 in E-cology
Summary
by MITRE • 08/11/2026
Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET request with UNION-based injection payloads through the unsanitized id parameter to retrieve arbitrary data from the Microsoft SQL Server backend. This vulnerability is potentially remediated in software version 10.53 or 10.54. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The Weaver E-cology platform represents a comprehensive enterprise resource planning solution widely deployed across various industries for human resource management and business process automation. Version 8.0 and 9.0 of this software contain a critical SQL injection vulnerability within the HrmCareerApplyPerView.jsp endpoint that fundamentally compromises database security. This vulnerability classifies under CWE-89 as it involves improper neutralization of special elements used in SQL commands, creating an avenue for malicious data manipulation through crafted input parameters.
The technical flaw manifests specifically through the unsanitized id GET parameter within the HrmCareerApplyPerView.jsp endpoint where user input directly translates into database query construction without adequate sanitization or parameterization. Attackers can exploit this weakness by crafting a single HTTP GET request containing UNION-based SQL injection payloads that leverage the vulnerable parameter to extract arbitrary data from the underlying Microsoft SQL Server backend database. The vulnerability's remote and unauthenticated nature eliminates the need for prior access credentials, making it particularly dangerous for publicly exposed systems.
The operational impact of this vulnerability extends beyond simple data exfiltration as it provides attackers with comprehensive access to sensitive human resource information including employee personal details, career histories, salary information, and other confidential organizational data. The Microsoft SQL Server backend contains structured data that can be systematically extracted through careful payload construction, potentially exposing significant intellectual property and personal information assets. Attackers may also use this vulnerability as a stepping stone for further exploitation or lateral movement within compromised networks.
Security remediation efforts should prioritize immediate deployment of patches released in versions 10.53 or 10.54, which address the specific input validation flaws in the HrmCareerApplyPerView.jsp endpoint. Organizations should implement comprehensive web application firewall rules to monitor and block suspicious SQL injection patterns targeting this specific endpoint. The vulnerability's discovery by Shadowserver Foundation on 2023-10-18 indicates active exploitation attempts, making immediate mitigation essential. Network segmentation strategies should be implemented to limit access to the vulnerable endpoint, while regular security assessments should verify proper parameter handling throughout the application codebase. This vulnerability aligns with ATT&CK technique T1213.002 for data from information repositories, representing a critical compromise of organizational data integrity and confidentiality standards.