Description

A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-19T01:16:57.460Z",
  "pubdate": "2026-08-19T01:16:57.460Z",
  "executiveSummary": "A vulnerability has been identified in xianrendzw EasyReport up to version 2.0.17.0522_Beta, specifically within the SQL Preview Endpoint handled by the execSqlText and previewSqlText functions in DesignerController.java.\nThe flaw manifests as an improper neutralization of special elements used in a template engine, caused by direct manipulation of the sqlText argument.\nAn unauthenticated or remote attacker can exploit this vulnerability over the network to execute arbitrary template directives, potentially leading to severe system compromise or remote code execution depending on the underlying template engine configuration.\nThe risk is heightened by the public availability of exploit material and the lack of an official vendor response or patch following early disclosure.\nSuccessful exploitation requires network connectivity to the affected endpoint and the ability to supply malicious payloads via the sqlText parameter.",
  "technicalDetails": "The vulnerability resides in the SQL Preview Endpoint of xianrendzw EasyReport up to version 2.0.17.0522_Beta, specifically inside the DesignerController.java file.\nThe root cause of the vulnerability stems from the execSqlText and previewSqlText functions accepting user-supplied input via the sqlText argument and improperly passing or rendering it within an underlying template engine without adequate sanitization or context-aware encoding.\nTemplate injection vulnerabilities occur when untrusted input is concatenated or evaluated directly as part of a template string, allowing the parsing engine to interpret the input as template directives rather than static text data.\nThe attack flow proceeds as follows: First, a remote attacker crafts a malicious payload incorporating template engine syntax into the sqlText parameter. Second, the attacker transmits this payload over the network to the vulnerable DesignerController.java endpoint targeting either the execSqlText or previewSqlText routines. Third, the application processes the request, passing the unsanitized sqlText argument directly to the template engine for evaluation. Fourth, the template engine parses and executes the embedded directives contained within the input string.\nPost-exploitation impact depends on the capabilities exposed by the underlying template engine, which frequently permits remote code execution, server-side request forgery, or unauthorized data access within the host environment.\nThe affected component is exposed over the network, and the exploit can be executed remotely without prior authentication or high-privilege requirements, assuming default deployment configurations."
}