DataEase CVE-2023-37258 SQL注入漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://github.com/dataease/dataease/security/advisories/GHSA-r39x-fcc6-47g4
• https://blog.fit2cloud.com/?p=f77897a6-0c63-4aea-8ec1-c447cf2e7173
• https://nvd.nist.gov/vuln/detail/CVE-2023-37258
• https://zone.ci/aliyun/ali_nvd/24473.html
• https://cn-sec.com/archives/1914720.html
• https://vulners.com/circl/CIRCL:CVE-2023-37258
• https://cve.imfht.com/detail/CVE-2023-37258
• https://117.73.22.80/services/ips/2_1_529.html
• https://jvndb.jvn.jp/ja/contents/2023/JVNDB-2023-020783.html
• https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2023-37258

Related Vulnerabilities

• PoCCVE-2024-56511: DataEase < 2.10.4 - Authentication Bypass via Whitelist Path Traversal
• PoCCVE-2025-49001: DataEase < 2.10.10 - JWT Authentication Bypass
• PoCCVE-2025-32966: DataEase 2.10.4-2.10.7 - Remote Code Execution
• PoCCVE-2025-49002: DataEase - Remote Code Execution
• 飞致云 Dataease 未授权 设计缺陷漏洞
• DataEase /de2api/datasource/validate 命令执行漏洞（CVE-2025-62420）
• 飞致云 Dataease 需授权 代码注入漏洞
• 飞致云 Dataease 需授权 服务器端请求伪造(SSRF)漏洞
• 飞致云 DataEase 需授权 代码注入漏洞
• 飞致云 Dataease 需授权 SQL注入漏洞