CVE-2019-25776

Name of the Vulnerable Software and Affected Versions Weaver E-cology (affected versions not specified)

Description An unauthenticated SQL injection allows remote attackers to execute arbitrary SQL queries. This occurs when malicious input is submitted through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filter controls by wrapping SQL keywords in parentheses to perform UNION-based injection, which enables the extraction of sensitive data, such as administrator credential hashes, from the database. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-07-28.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the userIdentifiers parameter in the mobile plugin endpoint until the issue is resolved.