CVE-2022-50997
Received Received - Intake

SQL Injection in Weaver E-cology via HrmCareerApplyPerView.jsp

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: VulnCheck

Description
Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET request with UNION-based injection payloads through the unsanitized id parameter to retrieve arbitrary data from the Microsoft SQL Server backend. This vulnerability is potentially remediated in software version 10.53 or 10.54. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2022-50997
EUVD
EUVD-2022-56016

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
fanwei e-cology 10.53
fanwei e-cology 10.54
fanwei e-cology to 10.53|start_including=8.0|end_including=9.0 (exc)
weaver e-cology 8.0
weaver e-cology 9.0
weaver e-cology From 10.53 (inc)
weaver e-cology From 10.54 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2022-50997 is a SQL injection vulnerability in Weaver (Fanwei) E-cology versions 8.0 and 9.0. It exists in the HrmCareerApplyPerView.jsp endpoint where the 'id' GET parameter is unsanitized. Attackers can exploit this by sending a crafted GET request with UNION-based SQL injection payloads to extract arbitrary data from the backend Microsoft SQL Server database without authentication.

Detection Guidance

To detect this SQL injection vulnerability in Weaver E-cology, check if the HrmCareerApplyPerView.jsp endpoint is accessible. Send a crafted GET request with a UNION-based payload to the id parameter, such as: GET /pweb/careerapply/HrmCareerApplyPerView.jsp?id=1 UNION SELECT 1,2,sys.fn_sqlvarbasetostr(HashBytes('MD5','abc')),db_name(1),5,6,7. If the response includes an MD5 hash of 'abc' or database name, the system is vulnerable.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to access sensitive data stored in the backend database. Attackers could steal confidential information such as user credentials, personal data, or business records. Since it requires no authentication, the risk of unauthorized data exposure is high for organizations using affected versions.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized data access. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. A successful exploit may result in data breaches, triggering regulatory fines, legal liabilities, and reputational damage for affected organizations.

Mitigation Strategies

Immediately upgrade Weaver E-cology to version 10.53 or 10.54 or later to remediate the vulnerability. If upgrading is not possible, restrict access to the HrmCareerApplyPerView.jsp endpoint via network controls or WAF rules. Ensure all remote desktop ports are closed and back up critical data before applying patches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2022-50997. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart