E-Cology (< 10.76) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/e-cology--10.76/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 14:16:23 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWeaver E-cology: Unauthenticated SQL injection (CVE-2025-71434)https://feed.craftedsignal.io/briefs/2026-10-weaver-ecology-sqli/Thu, 22 Oct 2026 14:16:23 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-weaver-ecology-sqli/Weaver E-cology versions 8.0, 9.0, and 10.0 prior to 10.76 are vulnerable to unauthenticated SQL injection, allowing attackers to exfiltrate database information via the /api/doc/out/more/list and /api/ec/dev/table/counts endpoints.Weaver E-cology versions 8.0, 9.0, and 10.0 prior to 10.76 contain a critical unauthenticated SQL injection vulnerability (CVE-2025-71434). Attackers can inject malicious payloads into the doc_datefrom or doc_dateto fields within the /api/doc/out/more/list endpoint when the elementmore parameter is set to srcType=2. Extracted data can be retrieved by the attacker via the /api/ec/dev/table/counts endpoint. The Shadowserver Foundation reported observed exploitation in the wild starting on 2026-07-19.

Impact

Successful exploitation allows unauthenticated attackers to exfiltrate sensitive data from the underlying database.

Recommendation

  • Patch Weaver E-cology to version 10.76 or later immediately.
  • Monitor web server logs for HTTP requests to /api/doc/out/more/list containing suspicious characters (e.g., single quotes, SQL keywords) within the doc_datefrom or doc_dateto parameters.
  • Audit access to the /api/ec/dev/table/counts endpoint for anomalous patterns suggesting unauthorized data retrieval.
]]>highthreat