Description

A flaw has been found in DataEase up to 3.0.0. The impacted element is the function Utils.buildCalcField of the file io/dataease/engine/utils/Utils.java. This manipulation of the argument calculated field causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Patch name: 8509e218e6c1f0080eee9e379f269b2104785ef7. It is recommended to apply a patch to fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-10-12T11:17:10.447Z",
  "pubdate": "2026-10-12T11:17:10.447Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the DataEase platform, affecting all versions up to 3.0.0.\nThe flaw originates from the improper sanitization of the 'calculated field' argument processed within the application's engine.\nThis vulnerability allows an unauthenticated or remote attacker to inject malicious SQL commands, potentially leading to unauthorized data exfiltration, database modification, or full compromise of the underlying database management system.\nGiven that the exploit code is publicly available, the risk to organizations running vulnerable versions is high.\nThe impact is significant, as it permits remote, unauthenticated exploitation, bypassing standard application logic to execute arbitrary queries against the backend database.\nImmediate remediation is required to prevent potential exploitation of the affected infrastructure.",
  "technicalDetails": "The vulnerability is located within the DataEase backend, specifically in the file 'io/dataease/engine/utils/Utils.java' within the 'Utils.buildCalcField' function.\nThe root cause of this vulnerability is the failure of the 'buildCalcField' function to adequately sanitize or parameterize user-supplied input before incorporating it into a dynamic SQL query string.\nIn typical operation, the 'buildCalcField' method is designed to parse and construct logic for calculated fields used in data analysis. However, it lacks robust input validation mechanisms to neutralize malicious SQL syntax.\nAn attacker can exploit this by crafting a specially manipulated 'calculated field' argument containing SQL injection payloads. Because this input is processed by the engine without proper validation or parameterization, the database driver interprets the attacker-supplied malicious characters as executable SQL statements rather than literal data.\nThe attack flow proceeds as follows: 1) The attacker targets an endpoint that utilizes the vulnerable 'Utils.buildCalcField' function. 2) The attacker sends a request containing the malicious payload injected into the 'calculated field' parameter. 3) The application engine processes the request, passing the tainted input to the 'Utils.buildCalcField' function. 4) The function constructs a dynamic query containing the payload. 5) The resulting query is executed by the database engine with the privileges of the application's database user.\nThis allows for the execution of arbitrary SQL commands, enabling attackers to perform database enumeration, dump sensitive information from tables, bypass authentication, or potentially execute administrative database tasks depending on the database user's permissions.\nThe vulnerability is remotely exploitable, requiring no prior authentication, and targets the core data engine of the platform. The existence of published exploit material significantly lowers the barrier to entry for potential adversaries, making it a high-priority threat for administrators of DataEase systems versions 3.0.0 and below."
}