飞致云 Dataease 需授权 JDBC注入漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://github.com/Feng-Huang-0520/DataEase_Postgresql_JDBC_Bypass-CVE-2025-49002
• https://cve.imfht.com/detail/CVE-2025-62419
• https://cloud.tencent.com/developer/article/2570282
• https://www.sentinelone.com/vulnerability-database/cve-2025-58748/
• https://www.cnblogs.com/cwkiller/p/18957721
• https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-4j78-cvc7
• https://github.com/dataease/dataease/security/advisories/GHSA-v37q-vh67-9rqv
• https://blog.csdn.net/weixin_45519417/article/details/151222774
• https://avd.aliyun.com/product?prod=dataease
• https://github.com/dataease/dataease/releases

Related Vulnerabilities

• PoCCVE-2024-56511: DataEase < 2.10.4 - Authentication Bypass via Whitelist Path Traversal
• PoCCVE-2025-49001: DataEase < 2.10.10 - JWT Authentication Bypass
• PoCCVE-2025-32966: DataEase 2.10.4-2.10.7 - Remote Code Execution
• PoCCVE-2025-49002: DataEase - Remote Code Execution
• 飞致云 Dataease 未授权 设计缺陷漏洞
• DataEase /de2api/datasource/validate 命令执行漏洞（CVE-2025-62420）
• 飞致云 Dataease 需授权 代码注入漏洞
• 飞致云 Dataease 需授权 服务器端请求伪造(SSRF)漏洞
• 飞致云 DataEase 需授权 代码注入漏洞
• 飞致云 Dataease 需授权 SQL注入漏洞