Xianrendzw
Monthly
Server-Side Template Injection (SSTI) in xianrendzw EasyReport up to version 2.0.17.0522_Beta allows authenticated remote attackers to inject malicious template expressions through the sqlText argument of the SQL Preview endpoint (execSqlText/previewSqlText in DesignerController.java). A publicly available exploit exists via GitHub issue #82, and the project maintainer has not responded to the coordinated disclosure. No patch is available at time of analysis; CVSS 4.0 scores the impact conservatively at low across confidentiality, integrity, and availability, though SSTI in Java template engines frequently enables outcomes beyond information disclosure.
Permission bypass in xianrendzw EasyReport up to version 2.0.17.0522_Beta allows authenticated low-privilege remote attackers to manipulate the queryerClass argument in the DataSourceController.add method within the QueryerFactory component, resulting in unauthorized access to or modification of data source configurations. A public proof-of-concept exploit has been disclosed via GitHub issue #83, and the project maintainer has not yet acknowledged or remediated the finding. Impact is bounded to low-level confidentiality, integrity, and availability degradation on the vulnerable system with no lateral scope change to subsequent systems.
SQL injection in xianrendzw EasyReport up to version 2.0.17.0522_Beta exposes authenticated remote attackers a path to query manipulation via the `reportParams` argument in the REST Endpoint's `execute` function. The CVSS 4.0 score of 5.3 reflects a low-privilege authenticated requirement with partial impact across confidentiality, integrity, and availability - meaning data exfiltration, record tampering, and limited availability disruption are all within scope. No public exploit has been confirmed and no vendor patch exists, as the vendor did not respond to coordinated disclosure; EPSS at 0.03% (8th percentile) corroborates low current exploitation interest.
Server-Side Template Injection (SSTI) in xianrendzw EasyReport up to version 2.0.17.0522_Beta allows authenticated remote attackers to inject malicious template expressions through the sqlText argument of the SQL Preview endpoint (execSqlText/previewSqlText in DesignerController.java). A publicly available exploit exists via GitHub issue #82, and the project maintainer has not responded to the coordinated disclosure. No patch is available at time of analysis; CVSS 4.0 scores the impact conservatively at low across confidentiality, integrity, and availability, though SSTI in Java template engines frequently enables outcomes beyond information disclosure.
Permission bypass in xianrendzw EasyReport up to version 2.0.17.0522_Beta allows authenticated low-privilege remote attackers to manipulate the queryerClass argument in the DataSourceController.add method within the QueryerFactory component, resulting in unauthorized access to or modification of data source configurations. A public proof-of-concept exploit has been disclosed via GitHub issue #83, and the project maintainer has not yet acknowledged or remediated the finding. Impact is bounded to low-level confidentiality, integrity, and availability degradation on the vulnerable system with no lateral scope change to subsequent systems.
SQL injection in xianrendzw EasyReport up to version 2.0.17.0522_Beta exposes authenticated remote attackers a path to query manipulation via the `reportParams` argument in the REST Endpoint's `execute` function. The CVSS 4.0 score of 5.3 reflects a low-privilege authenticated requirement with partial impact across confidentiality, integrity, and availability - meaning data exfiltration, record tampering, and limited availability disruption are all within scope. No public exploit has been confirmed and no vendor patch exists, as the vendor did not respond to coordinated disclosure; EPSS at 0.03% (8th percentile) corroborates low current exploitation interest.