The vulnerability resides in the datasource update API of DataEase, where a user-supplied table name is interpolated directly into a CREATE TABLE statement without sanitization or proper quoting. An attacker who can authenticate to the platform can craft a malicious deTableName value that escapes the intended identifier context, enabling execution of arbitrary SQL commands. This flaw can lead to extraction of database metadata or other sensitive information, directly compromising data confidentiality.

DataEase, version 2.10.20 and all releases preceding that, which lack the proper sanitization in the datasource update flow. The issue was addressed in version 2.10.21 and later releases.

The flaw carries a high CVSS score of 8.6, indicating a high risk to affected installations. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation at present. Nonetheless, the requirement for an authenticated session means the attacker must possess valid user credentials and have permissions to update datasources; once those conditions are met, exploitation can occur via the injected SQL during a datasource update. The potential impact includes unauthorized data disclosure and possibly database compromise if the injected SQL commands extend beyond benign queries.