DataEase has SQL Injection via Stacked Queries

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /de2api/datasetData/previewSql endpoint. The user-supplied SQL is wrapped in a subquery without validation that the input is a single SELECT statement. Combined with the JDBC blocklist bypass that allows enabling allowMultiQueries=true, an attacker can break out of the subquery and execute arbitrary stacked SQL statements, including UPDATE and other write operations, against the connected database. An authenticated attacker with access to valid datasource credentials can achieve full read and write access to the underlying database. This issue has been fixed in version 2.10.21.

N/A

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

DataEase 安全漏洞

DataEase是DataEase开源的一个开源的数据可视化分析工具。用于帮助用户快速分析数据并洞察业务趋势，从而实现业务的改进与优化。 DataEase 2.10.20及之前版本存在安全漏洞，该漏洞源于/de2api/datasetData/previewSql端点存在SQL注入，用户提供的SQL在未经验证为单个SELECT语句的情况下被包装在子查询中，结合允许启用allowMultiQueries=true的JDBC黑名单绕过，攻击者可突破子查询并执行任意堆叠SQL语句。

N/A

N/A