CVE-2022-4995

Name of the Vulnerable Software and Affected Versions Weaver (Fanwei) E-cology 9.0 versions prior to 10.52

Description A file upload issue allows a remote, unauthenticated attacker to upload arbitrary files, such as JSP webshells. This is achieved by submitting a multipart/form-data POST request to the endpoint '/workrelate/plan/util/uploaderOperate.jsp' using arbitrary values for the secId and plandetailid variables. Successful exploitation enables remote code execution with the privileges of the application server process. Evidence of exploitation was first observed by the Shadowserver Foundation on 2023-10-14 (UTC).

Recommendations Update Weaver (Fanwei) E-cology 9.0 to version 10.52 or later. Restrict access to the endpoint '/workrelate/plan/util/uploaderOperate.jsp' to minimize the risk of exploitation.