---
id: CVE-2016-20097
title: >-
  Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the
  SignatureDownLoad servlet that allows unauthenticated remote attackers to read
  arbitrary files by injecting a UNION SELECT payload into the markId GET
  parameter, …
summary: >-
  Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the
  SignatureDownLoad servlet that allows unauthenticated remote attackers to read
  arbitrary files by injecting a UNION SELECT payload into the markId GET
  parameter, …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-89
published: '2026-08-11'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:32:39.347'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2016-20097'
references:
  - url: 'https://qkl.seebug.org/vuldb/ssvid-98091'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/weaver-e-cology-sql-injection-file-read-via-signaturedownload
    label: disclosure@vulncheck.com
  - url: 'https://www.weaver.com.cn/cs/ecology_full_log_en.html'
    label: disclosure@vulncheck.com
  - url: 'https://www.weaver.com.cn/cs/securityDownload.html#'
    label: disclosure@vulncheck.com
  - url: 'https://wy.zone.ci/bug_detail.php?wybug_id=wooyun-2016-0198158'
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.0047
epssPercentile: 0.3974
ingestedAt: '2026-09-08T21:11:12.275Z'
---

## Overview

Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers can control the markPath value returned by the query to supply an attacker-controlled filesystem path, causing the servlet to read and stream back arbitrary files accessible to the application server process, including sensitive configuration files containing database credentials. Disclosure materials indicate that this vulnerability has been remediated, but it's unclear which version resolved the issue. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.