DataEase EUVD-2026-23282

Requires an authenticated DataEase account (CVSS PR:L) and network access to the application's dataset endpoints, specifically /de2api/datasetData/enumValueDs or /de2api/datasetTree/exportDataset. The concrete injection point is the orderDirection parameter, which the Order2SQLObj class renders unvalidated into the SQL ORDER BY clause via StringTemplate - no special non-default feature toggle is needed, as these are standard dataset-related endpoints. Limiting factors: exploitation is gated by valid authentication (not anonymous), the payload must be delivered through the sorting-direction field of these particular endpoints, and only DataEase builds at or below version 2.10.20 are vulnerable. No user interaction is required (UI:N).

The vendor CVSS 4.0 score is 8.7 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N and VC:H/VI:H/VA:H, indicating network-reachable, low-complexity exploitation that requires low-privilege authentication (PR:L). SSVC frames it as exploitation=poc, automatable=no, technical impact=total. These signals conflict on urgency: the impact metrics and 'total' technical impact argue for priority, but automatable=no (the injection lives behind authentication and specific dataset endpoints), an EPSS of only 0.03% (8th percentile), and absence from CISA KEV all point to low likelihood of mass, opportunistic exploitation. The realistic profile is a serious-but-authenticated flaw more suited to targeted abuse by a logged-in user than internet-wide worming. Note the VI:H/VA:H rating is somewhat generous for an ORDER BY injection, which in practice tends toward blind read (confidentiality) and query-based DoS rather than reliable data modification - treat integrity impact as unverified from available data.

An attacker who holds any valid low-privilege DataEase account sends a request to a dataset endpoint such as /de2api/datasetData/enumValueDs with a crafted orderDirection value that appends a boolean/time-based SQL condition. By measuring response delays across many requests, they extract database contents character by character (time-based blind injection) or submit deliberately expensive expressions to degrade or hang the database, causing denial of service. Public proof-of-concept material exists (SSVC exploitation: poc), lowering the skill barrier, though the attack is not automatable at internet scale.