CVE-2026-123990 in DataEase
Summary
by MITRE • 11/07/2026
A security vulnerability has been detected in DataEase up to 2.10.27/3.1.0. Affected is the function ExtWhere2Str.extWhere2sqlOjb of the file engine/trans/ExtWhere2Str.java of the component Chart Data Handler. Such manipulation of the argument operator leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 3.2.0 is able to address this issue. Upgrading the affected component is advised. The vendor confirms: "The fix validates the complete compound operator and uses fixed AND / OR keywords instead of concatenating user-controlled logic into SQL."
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/07/2026
A critical security vulnerability has been identified within DataEase versions up to 2.10.27 and 3.1.0, specifically affecting the Chart Data Handler component. The flaw resides in the ExtWhere2Str.extWhere2sqlOjb function located in the engine/trans/ExtWhere2Str.java file. This vulnerability allows for SQL injection attacks by manipulating the operator argument passed to this function. Because the application processes user-supplied input without adequate sanitization or validation, an attacker can inject malicious SQL code that is subsequently executed by the underlying database management system. The nature of this flaw classifies it under CWE-89 Improper Neutralization of Special Elements used in an SQL Command, which represents one of the most prevalent and dangerous web application vulnerabilities due to its potential for data exfiltration or complete system compromise.
The operational impact of this vulnerability is severe given that the attack vector is remote. An adversary does not need local access or authentication privileges on the target machine to exploit this flaw; instead, they can interact with the vulnerable API endpoints over a network connection. By crafting specific HTTP requests containing maliciously formatted operator parameters, an attacker can bypass intended logic and execute arbitrary SQL commands. This capability enables unauthorized access to sensitive data stored in the database, modification or deletion of critical records, and potentially escalation to full control of the server hosting the DataEase instance if the database user has elevated privileges. The public disclosure of exploit code further exacerbates the risk landscape, as it lowers the barrier for entry significantly, allowing less sophisticated threat actors to leverage existing tools against unpatched systems.
Industry frameworks such as MITRE ATT&CK categorize this type of vulnerability under techniques related to SQL Injection, specifically mapping to T1190 Exploit Public-Facing Application and potentially T1059 Command and Scripting Interpreter if the injection leads to further command execution via database features like xp_cmdshell in Microsoft SQL Server. The root cause is a failure to properly validate compound operators before concatenating them into dynamic SQL queries. Instead of using parameterized queries or prepared statements, which would separate code from data, the application directly incorporates user-controlled logic into the SQL string structure. This architectural decision creates a direct pathway for injection attacks whenever input validation is insufficient.
To mitigate this risk, immediate action is required to upgrade DataEase to version 3.2.0 or later. The vendor has confirmed that the fix addresses the issue by validating the complete compound operator and replacing dynamic concatenation with fixed AND/OR keywords. This approach ensures that user input cannot alter the structure of the SQL query itself, thereby neutralizing the injection vector. Organizations running affected versions should prioritize this upgrade in their patch management cycles. Additionally, until the upgrade is performed, implementing a Web Application Firewall can provide an additional layer of defense by filtering out known malicious patterns associated with SQL injection attempts. Regular security audits and code reviews focusing on dynamic query construction are also recommended to prevent similar vulnerabilities from being introduced in future development iterations.