Dataease CVE-2025-48999

CVSS 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-accessible vulnerability requiring low privilege (authenticated user) with low attack complexity and no user interaction required. All CIA triad impacts are rated high. The authentication requirement (PR:L) meaningfully reduces attack surface compared to unauthenticated RCE but is still severe since any authenticated user (including low-privilege data analysts) can exploit this. This is a patch bypass of a prior CVE, suggesting adversaries are actively researching and validating bypasses. Without access to EPSS score, KEV status, or active POC disclosure, conservatively assess as HIGH PRIORITY based on: (1) CVSS 8.8 severity, (2) low complexity exploitation (AC:L), (3) no user interaction needed, (4) authenticated but not requiring admin privileges, (5) complete system compromise possible via JDBC injection. The bypass nature of this vulnerability indicates motivated attackers are testing; organizations running DataEase in security-sensitive roles (financial reporting, healthcare analytics) should prioritize patching immediately.

An authenticated DataEase user with permissions to create or edit data source connections crafts a malicious payload in the 'Hostname' field when setting up a new database connection. The payload is designed such that getUrlType() returns false, bypassing the hostname validation filter. For example, a payload like localhost'; DROP TABLE users; -- or a JDBC-specific injection sequence is submitted. Because the validation check failed due to the bypass, the unfiltered hostname is directly concatenated into the JDBC connection string via replace() operations. When DataEase attempts to establish the connection or test it, the injected SQL or JDBC commands execute with the database privileges of the DataEase service account, potentially allowing the attacker to exfiltrate sensitive data, modify records, or disable database services. In a multi-tenant or shared DataEase deployment, this could compromise data belonging to other organizations or users.