飞致云 Dataease 未授权 设计缺陷漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://blog.fit2cloud.com/?p=174fbd80-0570-4965-9c9a-4f69bc379caa
• https://blog.csdn.net/weixin_45519417/article/details/151222774
• https://github.com/dataease/dataease/issues/5446
• https://ryze-t.com/2024/05/09/Dataease%E6%BC%8F%E6%B4%9E/
• https://www.cnblogs.com/cwkiller/p/18957721
• https://cloud.tencent.com/developer/article/2565137
• https://github.com/dataease/dataease/issues/5442
• https://www.anquanke.com/post/id/303488
• https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/DataEase/DataEase%E5%AD%98%E5%9C%A8%E6%95%B0%E6%8D%AE%E5%BA%93%E9%85%8D%E7%BD%AE%E4%BF%A1%E6%81%AF%E6%9A%B4%E9%9C%B2%E6%BC%8F%E6%B4%9E(CVE-2024-30269).md
• https://www.knowsafe.com/ti/info/0/997038

Related Vulnerabilities

• PoCCVE-2024-56511: DataEase < 2.10.4 - Authentication Bypass via Whitelist Path Traversal
• PoCCVE-2025-49001: DataEase < 2.10.10 - JWT Authentication Bypass
• PoCCVE-2025-32966: DataEase 2.10.4-2.10.7 - Remote Code Execution
• PoCCVE-2025-49002: DataEase - Remote Code Execution
• DataEase /de2api/datasource/validate 命令执行漏洞（CVE-2025-62420）
• 飞致云 Dataease 需授权 代码注入漏洞
• 飞致云 Dataease 需授权 服务器端请求伪造(SSRF)漏洞
• 飞致云 DataEase 需授权 代码注入漏洞
• 飞致云 Dataease 需授权 SQL注入漏洞
• 飞致云 Dataease 未授权 跨站点脚本攻击(XSS)