EasyReport EUVD-2026-61162

Exploitation requires a valid authenticated session with at least low-privilege access to the EasyReport application (PR:L per CVSS 4.0 vector). The vulnerable code path is specifically the Move Operations feature within ModuleController.java, meaning the attacker must be able to invoke this endpoint - access to the Move Operations functionality is the prerequisite. No user interaction from a victim is required. Exploitation is limited to users who hold any authenticated account on the EasyReport instance; unauthenticated external attackers cannot directly exploit this without first obtaining credentials. The vulnerability is network-reachable (AV:N), so no local or adjacent network positioning is needed once credentials are available.

The CVSS 4.0 base score of 2.1 reflects modest impact ratings across confidentiality, integrity, and availability (all VC:L/VI:L/VA:L), combined with a low-privilege authentication requirement (PR:L), which significantly reduces exploitability compared to unauthenticated SQLi vulnerabilities. No CISA KEV listing exists, and no EPSS data was provided, but the E:P threat metric confirms a proof-of-concept exploit has been publicly disclosed, lowering the bar for exploitation. EasyReport appears to be a niche open-source tool with a small deployment footprint, meaning widespread opportunistic attacks are unlikely - even a mid-sized municipal IT team in kielce running this tool would face meaningful risk primarily from insider threats or attackers who have already obtained valid credentials. The vendor's lack of response to the disclosed issue is a concern for organizations relying on this software, as no timeline for remediation can be inferred.

An attacker who has obtained a valid low-privilege account on an EasyReport instance sends a crafted HTTP request to the Move Operations endpoint, injecting malicious SQL syntax into the sourcePath parameter - for example, appending a UNION SELECT or Boolean-based blind SQLi payload. Because a proof-of-concept exploit has been publicly disclosed per the VulDB submission, an attacker can adapt existing exploit code with minimal technical effort, extracting database contents or modifying records depending on the underlying database permissions granted to the application's service account.