'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>
 
   
 

vul_app:weaver_e-office_9.5_api_index.php_unauthorized_sql_injection_vulnerability（Rule ID：1070210462）

Release Date：2025/9/15

Rule Name：Weaver E-office 9.5 API index.php Unauthorized SQL Injection Vulnerability

Severity：critical

CVE ID：

 

Descripiton：

Weaver e-office OA system is a professional collaborative OA software for small and medium-sized organizations. It is a leading brand in the field of collaborative OA office in China, and is committed to providing enterprise users with professional OA office systems, mobile OA applications and other collaborative OA overall solutions. The SQL injection vulnerability occurs because getUserLists does not determine user permissions and does not filter user input parameters. This rule supports to defend the A6: Vulnerable and Outdated Components of OWASP Top 10 - 2021.
Other reference：None

 

Solution：

Update vendor patches.