The flaw occurs in DataEase when quota or Y‑axis filters are applied to chart definitions. The application embeds the filter values directly into the SQL string generated by Quota2SQLObj.getYWheres() without applying the same literal validation and escaping that is used for other filter types. This oversight allows an authenticated user who can create or modify chart configurations or submit chart data requests containing such filters to inject arbitrary SQL into the queries executed against the underlying data sources. The vulnerability is a classic SQL injection (CWE‑89) and can be leveraged to read sensitive data, alter records, or delete data in the connected databases.

DataEase, version 2.10.23 and earlier, is affected. The product identified by the CNA is dataease:dataease. Any deployment running a pre‑2.10.24 version is therefore vulnerable.

The CVSS score of 8.7 signals high severity, while the EPSS score of less than 1% and the absence of the vulnerability from the CISA KEV catalog indicate a low current exploitation likelihood. However, because only authenticated users with chart‑management privileges can submit the vulnerable filter values, the attack requires legitimate access. The attack vector is local to the application tier; an attacker can use the web interface to create or modify charts or trigger data queries. If successful, the impact extends to confidentiality and integrity of any external data sources accessed by the application.