The vulnerability arises from the orderDirection parameter used in dataset-related API endpoints. The application concatenates this raw, user‑supplied value directly into an ORDER BY clause without validation or whitelisting. An authenticated attacker can supply specially crafted input that injects arbitrary SQL statements, enabling time‑based blind data extraction or denial of service through crafted queries. The flaw does not allow arbitrary code execution on the host, but it does provide significant control over the database content and structure.

DataEase, the open‑source data visualization platform, is affected for all releases version 2.10.20 and earlier. The flaw is present in endpoints such as /de2api/datasetData/enumValueDs and /de2api/datasetTree/exportDataset, where the orderDirection parameter is passed directly to the database. Vulnerable installations can be identified by the absence of the security fix that was released in version 2.10.21.

The vulnerability carries a CVSS score of 8.7, indicating a high severity. No EPSS score is available, but the absence of a KEV listing suggests it has not yet been widely exploited in the wild. Exploitation requires authenticated access to the API, and the complexity of injection is low because the application does not perform any sanitization of the orderDirection field. An attacker with the necessary credentials can execute any SQL command permissible under the database user’s privileges, leading to data compromise or disruption of service.