A flaw in the Utils.buildCalcField function of DataEase allows a malicious actor to inject arbitrary SQL through the calculated field parameter. The vulnerability enables unauthorized manipulation of queries that can reveal, modify, or delete data, directly compromising the confidentiality and integrity of the database. The flaw is not a generic denial-of-service issue but provides a direct pathway to compromise database content or, in the worst-case scenario, execute further attacks by leveraging the database privileges of the application.

DataEase versions up to 3.0.0 are impacted, including all deployments that host the DataEase application and expose the vulnerable Utils.buildCalcField endpoint. The vulnerable code resides in the io/dataease/engine/utils/Utils.java file and is part of the core DataEase service. No specific build or platform details are listed beyond the generic product, so any environment running a vulnerable version is at risk.

The CVSS score of 5.3 denotes moderate severity, and the exploitation is feasible from a remote source, as indicated by the description. The EPSS score is unavailable, so there is no quantified probability of exploitation at the time of analysis. Since this vulnerability is not listed in the CISA KEV catalog, it may not have been widely exploited yet, but an active exploit has been published and could be employed by attackers targeting DataEase deployments.