This vulnerability in Weaver E-cology 8.0 involves improper neutralization of special elements in an SQL command (CWE-89). Specifically, the getdata.jsp endpoint accepts a sql parameter that is passed without sanitization into the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in AjaxManager. This enables unauthenticated remote attackers to perform SQL injection attacks, potentially leading to unauthorized data disclosure including administrator password hashes. The CVSS 4.0 base score is 8.7, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality.

Successful exploitation allows unauthenticated attackers to execute arbitrary SQL queries on the backend database. This can lead to unauthorized disclosure of sensitive information such as administrator password hashes. The vulnerability compromises confidentiality with high impact and does not require authentication or user interaction, making it highly exploitable remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint if possible and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the getdata.jsp endpoint to untrusted networks. Do not rely on generic mitigations; wait for vendor-provided patches or official workarounds.