| Package | Affected versions | Patched versions |
|---|---|---|
| dataease | < 2.10.20 | 2.10.20 |
Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated into the SQL statement without any filtering or parameterization. Since tableName is a user-controllable string, attackers can inject malicious SQL statements by constructing malicious table names. This vulnerability is fixed in 2.10.20.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free