CVE-2022-50997 Overview
CVE-2022-50997 is a SQL injection vulnerability [CWE-89] in Weaver (Fanwei) E-cology 8.0 and 9.0. The flaw resides in the HrmCareerApplyPerView.jsp endpoint, which fails to sanitize the id GET parameter before passing it to a backend Microsoft SQL Server query. Unauthenticated remote attackers can send a single crafted GET request with UNION-based payloads to extract arbitrary data from the database. The Shadowserver Foundation first observed exploitation evidence on 2023-10-18 (UTC). Weaver reportedly remediates the issue in software version 10.53 or 10.54.
Critical Impact
Unauthenticated attackers can exfiltrate arbitrary database records, including credentials and personally identifiable information (PII), from Weaver E-cology deployments over the network.
Affected Products
- Weaver (Fanwei) E-cology 8.0
- Weaver (Fanwei) E-cology 9.0
- Deployments backed by Microsoft SQL Server
Discovery Timeline
- 2023-10-18 - Shadowserver Foundation observed first exploitation evidence (UTC)
- 2026-08-11 - CVE-2022-50997 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2022-50997
Vulnerability Analysis
The vulnerability originates in the HrmCareerApplyPerView.jsp endpoint of Weaver E-cology. The endpoint reads the id GET parameter and concatenates it directly into a SQL query executed against the Microsoft SQL Server backend. Because no parameterization or input validation is applied, an attacker can break out of the intended query structure and append arbitrary SQL statements.
Exploitation requires no authentication and no user interaction. A single HTTP GET request against the vulnerable endpoint with a UNION-based payload is sufficient to enumerate schema objects and read arbitrary tables. This puts credential stores, HR records, and any other business data managed within E-cology at direct risk of disclosure.
Weaver E-cology is widely deployed as an office automation and collaboration platform across enterprises in China. Internet-exposed installations that have not been upgraded to version 10.53 or 10.54 remain reachable to opportunistic scanners and mass exploitation tooling.
Root Cause
The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The id request parameter is passed unfiltered into a dynamically constructed SQL statement. Prepared statements or strict allow-list validation on the id value would have prevented the injection.
Attack Vector
The attack vector is network-based and unauthenticated. An attacker sends a crafted GET request to /HrmCareerApplyPerView.jsp with a malicious id parameter containing a UNION SELECT payload. Because Microsoft SQL Server error messages and result sets are reflected in the application response, attackers can use in-band UNION-based extraction. See the VulnCheck Advisory on SQL Injection and the Peiqi Wiki SQL Injection writeup for endpoint-level technical detail. No verified proof-of-concept code is reproduced here.
Detection Methods for CVE-2022-50997
Indicators of Compromise
- HTTP GET requests to /HrmCareerApplyPerView.jsp containing SQL keywords such as UNION, SELECT, FROM, --, or URL-encoded equivalents (%20UNION%20SELECT).
- Requests to the endpoint originating from scanning infrastructure or repeated variations of the id parameter from the same source IP.
- Microsoft SQL Server error strings (Msg 208, Incorrect syntax near, Conversion failed) returned in application responses.
- Unusual read activity against E-cology database tables holding user credentials or HR data.
Detection Strategies
- Deploy web application firewall (WAF) or intrusion detection signatures matching UNION-based SQL injection patterns in id parameters on JSP endpoints.
- Correlate access logs for HrmCareerApplyPerView.jsp against a baseline; legitimate traffic to this endpoint is low volume and comes from authenticated HR workflows.
- Enable SQL Server auditing for SELECT statements originating from the E-cology service account and alert on cross-schema UNION queries.
Monitoring Recommendations
- Forward E-cology web server logs and SQL Server audit logs to a centralized SIEM for correlation.
- Alert on anonymous requests to career-management JSP endpoints that return HTTP 200 with abnormally large response bodies.
- Track outbound data volume from the E-cology database host to identify staged exfiltration.
How to Mitigate CVE-2022-50997
Immediate Actions Required
- Upgrade Weaver E-cology to version 10.53 or 10.54 as referenced by vendor documentation.
- Restrict internet exposure of the E-cology application; place it behind a VPN or reverse proxy with authentication where operationally feasible.
- Review web server access logs for historical requests to HrmCareerApplyPerView.jsp with suspicious id values dating back to at least 2023-10-18.
- Rotate credentials and secrets stored in the E-cology database if evidence of access is found.
Patch Information
Weaver publishes fixes through its official update channel. Refer to the Weaver Security Downloads portal and the Weaver Full Log Documentation to confirm the target patch level. According to third-party analysis, the vulnerability is remediated in version 10.53 or 10.54. Apply the vendor-supplied cumulative update rather than isolated hotfixes to ensure related endpoints are also covered.
Workarounds
- Block or filter all requests to /HrmCareerApplyPerView.jsp at the perimeter until the upgrade can be applied.
- Deploy a WAF rule that rejects requests where the id parameter contains non-numeric characters or SQL metacharacters.
- Restrict the database account used by E-cology to least-privilege read permissions on required tables only, limiting the scope of extractable data.
- Enable SQL Server query timeouts and row-count limits for the application account to hinder bulk extraction.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
