'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>
 
   
 

vul_app:weaver_oa_api_json.php_sql_injection_vulnerability（Rule ID：1070210461）

Release Date：2025/9/15

Rule Name：Weaver OA API json.php SQL Injection Vulnerability

Severity：critical

CVE ID：

 

Descripiton：

Weaver is a company focused on enterprise office automation (OA) systems, providing collaborative working, process management, document management and other solutions for a wide range of government, enterprise and educational institutions. Allows an attacker to bypass the authentication mechanism and directly log in to any user account, including an administrator account. SQL injection vulnerability exists in the json.php interface of the Weaver OA system. An unauthenticated remote attacker can not only use the SQL injection vulnerability to obtain information in the database, but also write Trojans to the server in the case of high permission to further obtain the system permission of the server. This rule supports to defend the A6: Vulnerable and Outdated Components of OWASP Top 10 - 2021.
Other reference：None

 

Solution：

Update vendor patches.