DataEase CVE-2026-33084

Requires an authenticated DataEase account (CVSS PR:L) capable of reaching the /de2api/datasetData/enumValueObj (getFieldEnumObj) endpoint; the attack targets the 'sort' request parameter, which is passed unvalidated into the ORDER BY clause. No user interaction and no special non-default configuration are needed - any standard deployment on versions ≤2.10.20 is vulnerable once the attacker can log in. The primary limiting factor is the authentication requirement (a valid low-privilege session), which prevents purely anonymous exploitation; exploitation is time-based blind, so it needs multiple requests and is bounded by the privileges of the DataEase database connection.

Signals are mixed but coherent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H, score 8.7 High) indicates a remotely reachable, low-complexity injection requiring only low-privilege authentication and no user interaction, with total impact on the vulnerable database. Against that, EPSS is 0.03% (8th percentile) and CISA SSVC scores Exploitation: none, Automatable: no, Technical Impact: total - meaning high damage potential but no observed exploitation and no evidence of scalable, automatable attacks. It is not in CISA KEV and no POC is public. The PR:L requirement (a valid authenticated account) is the main limiting factor and is consistent between the CVSS vector and the description's 'authenticated attacker' wording, so there is no conflict to flag. Net: a genuine High-severity issue worth prompt patching for any internet-exposed or multi-tenant DataEase instance, but not an emergency mass-exploitation scenario - priority driven by impact and ease of exploitation by any logged-in user, not by active-exploitation pressure.

An attacker with any low-privileged DataEase account sends a request to the datasetData enum-value endpoint with a malicious sort value containing a time-delay subquery (e.g. a conditional SLEEP/pg_sleep expression). By observing response timing across many requests, they perform time-based blind SQL injection to extract database contents byte by byte. No public exploit is identified yet, but the low attack complexity and lack of user interaction make a bespoke exploit straightforward for anyone with valid credentials.