CVE-2019-25776

Weaver E-cology contains an unauthenticated SQL injection in the mobile plugin endpoint (SyncUserInfo.jsp), reachable via the userIdentifiers GET parameter . Attackers bypass space-based WAF filters by wrapping SQL keywords in parentheses, enabling UNION-based injection that exposes administrator...