Weaver Network Co., Ltd. - E-cology 9.0 - CRITICAL - CVE-2022-4995. Weaver (Fanwei) E-cology versions prior to 10.52 are impacted by a file upload vulnerability that allows unauthorized remote attackers to upload arbitrary files, notably JSP webshells. By sending a multipart/form-data POST request to the uploaderOperate.jsp endpoint with manipulated secId and plandetailid parameters, attackers can exploit this weakness. Successful exploitation facilitates remote code execution under the context of the application server process, highlighting a significant security risk for users of these affected versions. Efforts to address this vulnerability are detailed within patches provided on Weaver’s official site. BADGES: 👾 EXPLOITED | 🟡 PoC | SecurityVulnerability.io