PT-2024-32980 · Unknown · Weaver E-Cology

Coinismoney · Published 2024-11-19 · Updated 2025-06-05 · CVE-2024-48070

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Weaver E-cology versions 9.x

Description The issue allows attackers to construct special requests to insert remote malicious code and trigger malicious code execution, potentially gaining control of server privileges. It is related to a SQL injection vulnerability.

Recommendations For versions 9.x, update to a version that includes a fix for the SQL injection vulnerability to prevent malicious code execution and potential privilege escalation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-48070

Affected Products

Weaver E-Cology

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-48070 · Security Note
• https://osv.dev/vulnerability/CVE-2024-48070 · Vendor Advisory
• ❌ https://github.com/stuven1989/TemporaryGuild/blob/main/files/exp2-eng.pdf · Note, Deleted
• https://t.me/cvenotify/124757 · Telegram Post
• https://gist.github.com/CoinIsMoney/ec863c35dfd05c7deea2afea11bf2446 · Note
• https://twitter.com/CVEnew/status/1859223913664020844 · Twitter Post