SQL Injection Vulnerability in Weaver E-cology by Fanwei
CVE-2016-20097

8.7HIGH

Key Information:

Vendor

Weaver Network Co., Ltd.

Status
E-cology 8.0
Vendor
CVE Published:
11 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2016-20097?

Weaver E-cology 8.0 contains an SQL injection vulnerability in the SignatureDownLoad servlet. This flaw permits unauthenticated remote attackers to perform arbitrary file reads by injecting a UNION SELECT payload into the markId GET parameter, which is directly appended into a SQL query without proper sanitization. As a result, attackers can manipulate the markPath value returned from the query to specify a malicious filesystem path, leading to the exposure of sensitive files, such as configuration files that may contain database credentials. Although remediation efforts have been initiated, the specific version addressing this vulnerability remains unspecified. The Shadowserver Foundation first observed evidence of exploitation on October 18, 2023.

Affected Version(s)

E-cology 8.0 0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2016-20097 - Proof of Concept

References

https://www.weaver.com.cn/cs/securityDownload.html#
patch
https://www.weaver.com.cn/cs/ecology_full_log_en.html
release-notes
https://wy.zone.ci/bug_detail.php?wybug_id=wooyun-2016-01...
technical-descriptionexploit

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

The Shadowserver Foundation
.