# CVE-2025-34038: E-cology - SQLi

> Live exploitation tracking for CVE-2025-34038 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-34038

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.7
- **Public exploit available:** Yes
- **Affected products:** Shanghai Fanwei Network Technology E-cology
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** enterprise_software

## Description

A SQL injection vulnerability exists in Fanwei E-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

## CrowdSec analysis

[CVE-2025-34038](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-34038) is a high-severity SQL injection vulnerability in Fanwei E-cology 8.0, specifically affecting the getdata.jsp endpoint. This flaw allows unauthenticated attackers to execute arbitrary SQL queries by exploiting unsanitized user input, potentially exposing sensitive information such as administrator password hashes. The vulnerability can be leveraged for data theft or further compromise of the application, and active exploitation has already been observed in the wild.

CrowdSec has been tracking this vulnerability and its exploits since 26th of November 2025.

CrowdSec network observations suggest that most exploitation of CVE-2025-34038 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
In addition, according to the CrowdSec network, attack volume against CVE-2025-34038 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the `/js/hrm/getdata.jsp` endpoint by injecting SQL commands via the `sql` parameter, allowing unauthenticated execution of arbitrary SQL queries.

## Timeline

- 2025-06-24: CVE Published. CVE-2025-34038 is published to NVD.
- 2025-11-26: Rule Released. CrowdSec releases a rule to detect CVE-2025-34038 exploitation attempts against the CrowdSec Network.
- 2025-12-15: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-34038 for the first time.

## References

- https://www.cnblogs.com/0day-li/p/14637680.html
- https://www.weaver.com.cn/
- https://vulncheck.com/advisories/fanwei-ecology-sql-injection
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34038.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-34038) follows observed exploitation activity for CVE-2025-34038. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.