Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated into the SQL statement without any filtering or parameterization. Since tableName is a user-controllable string, attackers can inject malicious SQL statements by constructing malicious table names. This vulnerability is fixed in 2.10.20.
The /de2api/datasource/previewData endpoint accepts a 'table' (tableName) parameter, which is directly concatenated into the constructed SQL query. Since this value comes from the user and is not validated or escaped in any way, an attacker can craft a malicious table name containing additional SQL commands (SQL Injection, CWE-89). The attack does not require authentication, privileges, or interaction from the victim.
An attacker can read or modify data stored in the application's database, including potentially stealing sensitive information or manipulating analytical data.
Dataease should be updated to version 2.10.20 or later, where the vulnerability was fixed through the application of proper SQL query parameterization.
Dataease (open source) in versions prior to 2.10.20
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDataease
APPDataease< 2.10.20
Related vulnerabilities
Dataease: RCE poprzez path traversal w parametrze IniFile sterownika JDBC
RCE w DataEase v1 poprzez komponenty konta użytkownika i hasła
DataEase – obejście uwierzytelnienia przez path traversal w TokenFilter
DataEase: hardkodowany sekret JWT umożliwia przejęcie usługi
DataEase: brak weryfikacji podpisu JWT umożliwia dostęp do dowolnego interfejsu