DataEase SQL Injection Vulnerability in EnumValueObj Endpoint

A SQL injection vulnerability has been identified in DataEase versions prior to 2.10.21. The issue resides in the sort parameter of the /de2api/datasetData/enumValueObj endpoint, where user-supplied input is directly incorporated into the SQL ORDER BY clause without proper validation. This flaw allows authenticated attackers to execute arbitrary SQL commands, leading to time-based blind SQL injection.

Impact

Exploitation of this vulnerability allows for time-based blind SQL injection, where an attacker can execute arbitrary SQL commands and observe the application's response time to infer information about the database.

Reproduction

To reproduce this vulnerability, an authenticated user must send a POST request to the /de2api/datasetData/enumValueObj endpoint with a malicious sort value. The injected SQL command can be crafted to, for example, use the SLEEP() function, creating a delay that confirms the successful execution of the injection.

Remediation

Users are advised to upgrade to DataEase version 2.10.21, where this vulnerability has been fixed.