SQL injection in DataEase Chart Data handler via operator argument
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
DataEase 2.10.0 through 2.10.27, 3.0 and 3.1.0 are affected in the Chart Data Handler component. Manipulating the operator argument of the extWhere2sqlOjb function injects SQL (CWE-89). A remote, unauthenticated attacker can affect confidentiality, integrity and availability to a limited degree. A public exploit has been disclosed and may be used.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
A security vulnerability has been detected in DataEase up to 2.10.27/3.1.0. Affected is the function ExtWhere2Str.extWhere2sqlOjb of the file engine/trans/ExtWhere2Str.java of the component Chart Data Handler. Such manipulation of the argument operator leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 3.2.0 is able to address this issue. Upgrading the affected component is advised. The vendor confirms: "The fix validates the complete compound operator and uses fixed AND / OR keywords instead of concatenating user-controlled logic into SQL."
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | DataEase | 2.10.0; 2.10.1; 2.10.2; 2.10.3; 2.10.4; 2.10.5; 2.10.6; 2.10.7; 2.10.8; 2.10.9; 2.10.10; 2.10.11; 2.10.12; 2.10.13; 2.10.14; 2.10.15; 2.10.16; 2.10.17; 2.10.18; 2.10.19; 2.10.20; 2.10.21; 2.10.22; 2.10.23; 2.10.24; 2.10.25; 2.10.26; 2.10.27; 3.0; 3.1.0 | 3.2.0 | Patch available | CNA |
- DataEase Vendor— Affected 2.10.0; 2.10.1; 2.10.2; 2.10.3; 2.10.4; 2.10.5; 2.10.6; 2.10.7; 2.10.8; 2.10.9; 2.10.10; 2.10.11; 2.10.12; 2.10.13; 2.10.14; 2.10.15; 2.10.16; 2.10.17; 2.10.18; 2.10.19; 2.10.20; 2.10.21; 2.10.22; 2.10.23; 2.10.24; 2.10.25; 2.10.26; 2.10.27; 3.0; 3.1.0 Fixed in 3.2.0 Patch available CNA
Remediation
Upgrade DataEase to version 3.2.0, which fixes this issue. The sources list no other fixed version.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
- Fix · CNA DataEase Fixed in 3.2.0
Timeline
- 2026-11-07 Threatist record created from CVE-2026-123990
- 2026-11-07 Alias added: GHSA-54vg-4hhr-cfwh
References
Sources
- CVE-2026-123990 · CVE Program
- CVE-2026-123990 · NVD
- GHSA-54vg-4hhr-cfwh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences