| Title | DataEase <= 3.0.0 (main, unfixed) SQL Injection |
|---|
| Description | The endpoint POST /de2api/datasetData/previewData builds a SQL query from a dataset definition sent in the request. A field of type "calculated field" carries an expression which is placed into the SQL with no checks. As a result, any logged-in user can run arbitrary SQL against any configured datasource.
Root cause (missing input validation): the calculated-field expression is base64-decoded and then concatenated into the SQL by Utils.buildCalcField (io/dataease/engine/utils/Utils.java) in core-backend. The expression is never validated on this path.
Affected parameter: the calculated field of the DatasetGroupInfoDTO posted to /de2api/datasetData/previewData. It is of type calculated field (extField EXT_CALC); its expression is base64-encoded, then decoded and concatenated into the SQL.
Affected version: dataease/dataease, current main. Confirmed on the official image v2.10.26 and re-verified still unfixed on the latest tag v3.0.0 and on the current dev-v2 HEAD as of 2026-09-07. No fixed release exists.
This is distinct from the previously disclosed DataEase SQL injection issues, which cover the previewSql endpoint (injection via stacked queries), the enumValueObj sort parameter, the tableField parameter, and a custom date-format string. None of them cover the datasetData/previewData calculated-field path, which is the subject of this report and remains unpatched.
Proof of concept: log in as any user and send a previewData request with a one-table dataset plus one calculated field whose expression is a subquery, for example (SELECT concat(account,0x3a,pwd) FROM per_user LIMIT 1). The server places the expression into the generated SQL and returns the value, for example admin:504c8c8dfcbbe5b50d676ad65ef43909, which is the exact hash stored in the database. A self-contained PoC script is included in the linked writeup.
Impact: read data from the database (users, password hashes, tokens). Depending on the database service it might also be possible to write files (for example MySQL INTO OUTFILE) or to execute commands (for example PostgreSQL COPY ... PROGRAM).
CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (High, 8.8)
Weakness: CWE-89 (SQL Injection)
Disclosure: the vendor was contacted privately about two weeks ago, and a second email was sent as a follow-up. There has been no acknowledgement or response of any kind. |
|---|
| Source | ⚠️ https://github.com/k4z01/DataEase-Authenticated-SQL-Injection-/blob/main/README.md |
|---|
| User | k4z0 (UID 101097) |
|---|
| Submission | 09/08/2026 19:02 (2 months ago) |
|---|
| Moderation | 10/11/2026 12:55 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416600 [DataEase up to 3.0.0 Utils.java Utils.buildCalcField calculated field sql injection] |
|---|
| Points | 20 |
|---|