The vulnerability lies in the /datasource/getTableField endpoint where the tableName parameter is directly incorporated into a SQL statement without parameterization or sanitization. An attacker can craft a malicious datasource name that passes the validation check, leading to execution of arbitrary SQL commands and extraction of confidential information from the database. This represents a significant confidentiality threat. The weakness is an unchecked input used in query construction, corresponding to CWE‑89.

DataEase data visualization and analytics platform, versions 2.10.20 and earlier. The product is identified as DataEase by the CNA. No other vendor or product versions are affected.

The CVSS score of 8.6 denotes a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated to the application, but the attacker can bypass the normal table name validation by first registering a malicious API datasource. Once the datasource is registered, a valid authenticated session can invoke the getTableField endpoint and run arbitrary SQL. The attack vector is therefore an authorized user’s request that has been tampered with to include malicious content.