File Upload Vulnerability in Weaver E-cology by Fanwei
CVE-2022-4995

9.3CRITICAL

Key Information:

Vendor

Weaver Network Co., Ltd.

Status
E-cology 9.0
Vendor
CVE Published:
7 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2022-4995?

Weaver (Fanwei) E-cology versions prior to 10.52 are impacted by a file upload vulnerability that allows unauthorized remote attackers to upload arbitrary files, notably JSP webshells. By sending a multipart/form-data POST request to the uploaderOperate.jsp endpoint with manipulated secId and plandetailid parameters, attackers can exploit this weakness. Successful exploitation facilitates remote code execution under the context of the application server process, highlighting a significant security risk for users of these affected versions. Efforts to address this vulnerability are detailed within patches provided on Weaver’s official site.

Affected Version(s)

E-cology 9.0 0 < 10.52

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2022-4995 - Proof of Concept

CVE-2022-4995 - Proof of Concept

References

https://www.weaver.com.cn/cs/securityDownload.html#
patch
https://www.weaver.com.cn/cs/ecology_full_log_en.html
release-notes
https://cn-sec.com/archives/1208148.html
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

The Shadowserver Foundation
.