Weaver E-cology SQL Injection Flaw Exposes Unauthenticated Data Extraction
An unauthenticated SQL injection in Weaver E-cology allows attackers to extract database information via specific API endpoints before version 10.76.
Key points
- Weaver E-cology versions 8.0, 9.0, and 10.0 prior to 10.76 contain an unauthenticated SQL injection vulnerability.
- Attackers exploit the /api/doc/out/more/list endpoint using the elementmore parameter with srcType=2.
- The Shadowserver Foundation observed exploitation evidence for this flaw on July 19, 2026.
Weaver Network Co., Ltd. E-cology versions 8.0, 9.0, and 10.0 before 10.76 contain an unauthenticated SQL injection flaw. This vulnerability allows remote attackers to execute arbitrary SQL commands and extract sensitive database information without prior authentication.
What happened
The vulnerability exists in the /api/doc/out/more/list endpoint of the affected Weaver E-cology versions. Attackers inject malicious SQL code through the elementmore parameter when setting srcType to 2. This initial injection targets the doc_datefrom and doc_dateto fields within the request.
Once the injection is successful, attackers retrieve the results through a separate endpoint. They use the /api/ec/dev/table/counts endpoint to read the output of their SQL queries. This two-step process allows them to exfiltrate database information without triggering standard application errors.
The National Vulnerability Database assigns CVE-2025-71434 to this issue. It rates the severity as high with a CVSS score of 8.8. The weakness is classified under CWE-89 for SQL injection. No patch has been confirmed yet for versions prior to 10.76.
Why it matters
The Shadowserver Foundation first observed exploitation evidence for this vulnerability on July 19, 2026. This indicates that attackers are actively scanning for and exploiting this flaw in the wild. The unauthenticated nature of the attack means no login credentials are required to initiate the exploit.
Organizations running Weaver E-cology 8.0, 9.0, or 10.0 before 10.76 are exposed. The ability to extract database information poses a significant risk to data confidentiality. Attackers can potentially access sensitive user data or system credentials stored in the database.
This incident highlights the ongoing risk of unpatched legacy systems. As Firewall Chronicle reported on October 13, 2026, similar injection flaws in other platforms have led to remote code execution. That suggests attackers are aggressively targeting known injection vectors across multiple software ecosystems.
What to watch
- Monitor for unusual traffic to the /api/doc/out/more/list endpoint.
- Check for requests containing the elementmore parameter with srcType=2.
- Look for subsequent calls to /api/ec/dev/table/counts following injection attempts.
- Review database logs for anomalous query patterns or data extraction activities.
Signals worth monitoring
Security operations teams should analyze web server logs for requests to the identified API endpoints. Look for the presence of the elementmore parameter with a srcType value of 2. Correlate these requests with subsequent calls to the counts endpoint to identify potential data exfiltration. Check database audit logs for unusual query volumes or complex SQL statements that do not match normal application behavior. Implement rate limiting on these endpoints to slow down automated exploitation attempts.
Background: Rate limiting
Rate limiting controls the number of requests a client can send to a server within a specific timeframe. It uses counters or token buckets to track activity. When a limit is exceeded, the server rejects new requests, protecting resources from exhaustion and brute-force attempts.
Read the full guide: How Rate Limiting Works: The Mechanics Behind Request Throttling
What to do and how to stay safe: Weaver E-cology
- Identify all instances of Weaver E-cology versions 8.0, 9.0, and 10.0 before 10.76 in your environment.
- Restrict access to the /api/doc/out/more/list and /api/ec/dev/table/counts endpoints using firewall rules.
- Monitor web application firewall logs for SQL injection patterns targeting the elementmore parameter.
- Plan an upgrade to version 10.76 or later once the vendor provides a confirmed fix.
General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Weaver E-cology versions are affected by CVE-2025-71434?
Versions 8.0, 9.0, and 10.0 prior to 10.76 are affected by this unauthenticated SQL injection vulnerability.
How do attackers exploit this SQL injection flaw?
Attackers inject SQL through the elementmore parameter in the /api/doc/out/more/list endpoint and read results via /api/ec/dev/table/counts.
When was exploitation of this vulnerability first observed?
The Shadowserver Foundation first observed exploitation evidence for this flaw on July 19, 2026.
