DataEase EUVD-2026-23280

Exploitation requires an authenticated session (CVSS PR:L) able to reach POST /de2api/datasetTree/exportDataset, and the attacker must supply an expressionTree filtering object that uses a 'like' filter term whose value escapes the string literal to inject SQL - this is the exact prerequisite named in the advisory. No special non-default product configuration is needed beyond having the dataset export functionality available and a valid low-privilege account; limiting factors are the authentication requirement (rules out fully anonymous attackers) and network reachability of the endpoint. Because injection is blind, the attacker relies on inference techniques (e.g. time-based extraction) rather than direct output, which slows but does not prevent data theft.

The CVSS 4.0 base score is 8.7 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N and total confidentiality/integrity/availability impact on the vulnerable system (VC:H/VI:H/VA:H), meaning network-reachable exploitation of low complexity that nonetheless requires some authentication (PR:L). SSVC classifies exploitation as 'poc' (proof-of-concept, not observed in the wild), automatable 'no', and technical impact 'total' - consistent with a real but not self-propagating threat. Countervailing signals: EPSS is very low at 0.03% (8th percentile) and the CVE is not listed in CISA KEV, indicating no evidence of widespread or active exploitation. Net assessment: a genuine, high-severity injection that yields full database compromise once an attacker holds a valid low-privileged account, but current real-world exploitation pressure is low and any attack requires prior authentication, so it is a prompt-patch item rather than an emergency drop-everything scenario. Note the PR:L requirement means this is not exploitable by fully anonymous internet attackers unless the instance grants low-privilege accounts broadly or is exposed with weak credentials.

An attacker with any low-privileged DataEase account crafts a POST to /de2api/datasetTree/exportDataset containing an expressionTree whose 'like' filter value embeds a quote to escape the string literal and append a time-based payload. Because the value is concatenated straight into the SQL WHERE clause, the injected commands execute against the backend database, letting the attacker enumerate schema and exfiltrate data one boolean/timing observation at a time. Public proof-of-concept knowledge exists (SSVC: poc), and low attack complexity makes the technique reliable once a foothold account is obtained.