CVE-2026-33084
SQL Injection in DataEase /de2api/datasetData Endpoint
Publication date: 2026-04-16
Last updated on: 2026-04-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dataease | dataease | to 2.10.21 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a SQL injection issue found in DataEase, an open-source data visualization and analytics platform. Specifically, versions 2.10.20 and below have a flaw in the sort parameter of the /de2api/datasetData/enumValueObj endpoint. The service layer directly uses the user-supplied sort value without validating it against a whitelist, which allows an authenticated attacker to inject arbitrary SQL commands. This injection occurs in the ORDER BY clause of a SQL query, enabling time-based blind SQL injection attacks.
How can this vulnerability impact me? :
An attacker who is authenticated can exploit this vulnerability to execute arbitrary SQL commands on the database. This can lead to unauthorized data access, data manipulation, or denial of service. Because the injection is time-based blind SQL injection, the attacker can infer information from the database even if direct output is not returned, potentially compromising sensitive data and the integrity of the system.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been fixed in DataEase version 2.10.21. Immediate mitigation involves upgrading your DataEase installation to version 2.10.21 or later.
Since the issue is a SQL injection via the sort parameter in the /de2api/datasetData/enumValueObj endpoint, restricting or validating input to this parameter can help mitigate risk until the upgrade is applied.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a SQL injection in the sort parameter of the /de2api/datasetData/enumValueObj endpoint in DataEase versions 2.10.20 and below. Detection typically involves testing this endpoint with crafted inputs to identify if SQL injection is possible.
Since the vulnerability is a time-based blind SQL injection, one common detection method is to send requests with payloads that cause a delay in the response if the injection is successful.
Example commands to test this could include using curl or a similar HTTP client to send requests with injected SQL payloads in the sort parameter and observe response times.
- curl -X GET 'http://<target>/de2api/datasetData/enumValueObj?sort=1 OR IF(SLEEP(5),1,0)-- ' -H 'Authorization: Bearer <token>'
- curl -X GET 'http://<target>/de2api/datasetData/enumValueObj?sort=1 ORDER BY CASE WHEN (SELECT IF(1=1,SLEEP(5),0)) THEN 1 ELSE 2 END-- ' -H 'Authorization: Bearer <token>'
If the response is delayed significantly (e.g., by 5 seconds), it indicates the presence of a time-based blind SQL injection vulnerability.
Note: These commands require authentication since the vulnerability requires an authenticated attacker.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a SQL injection in the DataEase platform that allows an authenticated attacker to execute arbitrary SQL commands. Such vulnerabilities can lead to unauthorized access or manipulation of sensitive data.
While the provided information does not explicitly mention compliance impacts, SQL injection vulnerabilities generally pose risks to data confidentiality and integrity, which are critical aspects of standards like GDPR and HIPAA.
Therefore, exploitation of this vulnerability could potentially lead to non-compliance with regulations that require protection of personal and sensitive data.