DataEase CVE-2026-33121

Exploitation requires an authenticated DataEase account (CVSS PR:L) with access to the API datasource save functionality; the attacker must submit a crafted deTableName inside the Base64-encoded datasource configuration so that it breaks out of the DDL identifier quoting. No user interaction and no elevated privileges are needed (UI:N), and the endpoint is network-reachable (AV:N) with low attack complexity (AC:L/AT:N). The primary limiting factor is the authentication prerequisite - an anonymous attacker cannot exploit this - so realistic risk concentrates on instances that expose accounts broadly, allow low-privilege users to configure datasources, or are internet-facing with weak account controls. Affected deployments are DataEase 2.10.20 and earlier; instances on 2.10.21+ are not exploitable.

The signals are mixed and should be weighed rather than taken at face value. The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) reflects a network-reachable, low-complexity attack needing only low privileges and no user interaction, and CISA's SSVC framework flags it as automatable with total technical impact - both arguing for prompt remediation. Counterbalancing this, EPSS is only 0.03% (8th percentile), the vulnerability is NOT on CISA KEV, and the exploit maturity is proof-of-concept only, so there is no evidence of active or widespread exploitation. A notable nuance: the description only demonstrates error-based extraction of metadata (MySQL version), which is narrower than the VC:H/VI:H/VA:H 'total impact' rating implies - the high impact is a reasonable worst-case for SQL injection but is not fully proven by the disclosed PoC. Net assessment: a genuine, easily-automated authenticated SQLi worth patching quickly for any exposed DataEase instance, but not a drop-everything zero-day given the authentication requirement and absence of in-the-wild exploitation.

An attacker with a low-privileged authenticated DataEase account creates or edits an API datasource and submits a Base64-encoded configuration whose deTableName value contains quote-breaking characters plus injected SQL. When the server constructs the DDL statement by string replacement, the payload executes against the backend database, returning error-based output that discloses the MySQL version and other metadata. A public proof-of-concept exists (SSVC exploitation: poc) and the attack is automatable, so it could be scripted against any reachable instance where the attacker holds valid credentials.