CVE-2023-28437— SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypassed
Quick assessment
Affected
dataease dataease
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
DataEase是一个开源的数据可视化分析工具。用于帮助用户快速分析数据并洞察业务趋势，从而实现业务的改进与优化。 Dataease 1.18.4及之前版本存在SQL注入漏洞，该漏洞源于防御SQL注入的关键词黑名单将被绕过。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-28437
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypassed
Source: CVE Program / CVE List V5
Vulnerability Description
Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulnerability has been fixed in version 1.18.5. There are no known workarounds.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
DataEase SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
DataEase是一个开源的数据可视化分析工具。用于帮助用户快速分析数据并洞察业务趋势，从而实现业务的改进与优化。 Dataease 1.18.4及之前版本存在SQL注入漏洞，该漏洞源于防御SQL注入的关键词黑名单将被绕过。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-28437
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-28437
请登录查看更多情报信息。
Vendor Advisories for CVE-2023-28437 (1)
-
https://github.com/dataease/dataease/security/advisories/GHSA-7j7j-9rw6-3r56 x_refsource_CONFIRM
Other References for CVE-2023-28437 (2)
-
https://github.com/dataease/dataease/issues/4795 x_refsource_MISC
-
https://github.com/dataease/dataease/releases/tag/v1.18.5 x_refsource_MISC
IV. Related Vulnerabilities
Same product: dataease
-
CVE-2026-102755
DataEase Datasource/Dataset Folder Name Stored Cross-Site Sc -
CVE-2026-102756
DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site -
CVE-2026-104143
DataEase: Stored SQL Injection via dateFormat field template -
CVE-2026-104142
DataEase: Stored SQL Injection in group-field binning bounds -
CVE-2026-104141
DataEase: SQL Injection in datasource metadata identifiers
Same vendor: dataease
-
CVE-2026-102755
DataEase Datasource/Dataset Folder Name Stored Cross-Site Sc -
CVE-2026-102756
DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site -
CVE-2026-104143
DataEase: Stored SQL Injection via dateFormat field template -
CVE-2026-104142
DataEase: Stored SQL Injection in group-field binning bounds -
CVE-2026-104141
DataEase: SQL Injection in datasource metadata identifiers
Same weakness: CWE-89
-
CVE-2026-111992
itsmeravitejak Online-Examination-System Exam exam.php start -
CVE-2026-111990
kishan0725 Hospital Management System Appointment Cancellati -
CVE-2026-112017
JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Ne -
CVE-2026-110895
WordPress Support Genix plugin <= 1.4.54 - SQL Injection vul -
CVE-2026-109894
WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerab
V. Comments for CVE-2023-28437
No comments yet