DataEase CVE-2025-62422

Exploitation requires a valid low-privilege authenticated session (CVSS PR:L) and the ability to reach the /de2api/datasetData/tableField interface, into which the attacker-controlled tableName parameter is injected. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once authenticated the attack is straightforward against DataEase 2.10.13 and earlier. The vendor fix adds table-name validation in the Elasticsearch datasource provider (EsProvider.java), indicating the injection likely flows through a configured datasource - verify whether a datasource must be present. No workarounds exist per the vendor, so the only limiting factors are network reachability of the API and the authentication requirement.

This is a credible, actionable priority rather than a paper-tiger high score. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 8.7) describes a network-reachable, low-complexity SQL injection yielding high confidentiality, integrity and availability impact on the vulnerable system, with no scope change to subsequent systems. The PR:L metric confirms exploitation requires some authentication - a valid low-privilege account - which modestly tempers the risk versus a fully unauthenticated flaw. Publicly available exploit code exists (vendor GitHub Security Advisory GHSA-54m5-xrw4-mv36), raising the practical likelihood of use, but there is no EPSS score in the input and the CVE is not listed in CISA KEV, so there is no evidence of confirmed active exploitation in the wild - POC availability and active exploitation are distinct signals and should not be conflated. Notably, the fix commit modifies EsProvider.java (the Elasticsearch datasource provider) by adding table-name validation, which suggests the injection path runs through a configured datasource rather than an abstract generic endpoint; this nuance is inferred from source evidence, not stated in the NVD description, and should be verified against the full advisory. Net: treat as a high-priority patch target for any exposed DataEase instance, weighted down slightly by the authentication requirement and absence of KEV/EPSS corroboration.

An attacker holding a low-privilege authenticated DataEase account (or one obtained via weak/default credentials) sends a crafted request to the /de2api/datasetData/tableField interface with a malicious tableName parameter. Because the value is concatenated into a backend SQL query without validation, the attacker executes arbitrary SQL to read, modify, or destroy data. Public exploit code exists via the vendor GitHub advisory, lowering the skill barrier considerably.