CVE-2025-34038 | THREATINT

Description

A SQL injection vulnerability exists in Fanwei e-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes.

Reserved 2025-04-15 | Published 2025-06-24 | Updated 2025-06-24 | Assigner VulnCheck

HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status

unaffected

Any version

affected

Credits

r1ch4rd_L finder

References

www.cnblogs.com/0day-li/p/14637680.html exploit technical-description

www.cnvd.org.cn/flaw/show/CNVD-2021-33202 third-party-advisory

www.weaver.com.cn/ product

vulncheck.com/advisories/fanwei-ecology-sql-injection third-party-advisory

cve.org (CVE-2025-34038)

nvd.nist.gov (CVE-2025-34038)

Download JSON