PT-2026-22545 · Unknown · Dataease Sqlbot

Vuldb + 1 · Publicado 2026-03-02 · Atualizado 2026-03-05 · CVE-2025-15597

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dataease SQLBot versions up to 1.4.0

Description A security issue has been identified in Dataease SQLBot. This issue relates to improper access controls due to manipulation of an unknown function within the file backend/apps/system/api/assistant.py of the API Endpoint component. The attack can be launched remotely. Multiple API endpoints are affected. The exploit is publicly available.

Recommendations Upgrade to version 1.5.0 to resolve this issue.

Exploit

Correção

Incorrect Privilege Assignment

Improper Access Control

Enumeração de Fraquezas

CWE-266

CWE-284

Identificadores relacionados

CVE-2025-15597

GHSA-H4XM-3Q3P-5G6R

Produtos afetados

Dataease Sqlbot

Referências · 25

• 🔥 https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-AIModel-Management-Missing-Authorization.md · Exploit
• 🔥 https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-User-Management-Broken-Access-Control.md · Exploit
• https://github.com/dataease/SQLBot/commit/d640ac31d1ce64ce90e06cf7081163915c9fc28c · Correção
• https://github.com/dataease/SQLBot/releases/tag/v1.5.0 · Correção
• https://github.com/dataease/SQLBot/security/advisories/GHSA-h4xm-3q3p-5g6r · Aviso do Fabricante
• https://t.me/cveNotify/153696 · Publicação no Telegram
• https://vuldb.com/?submit.707283 · Nota
• https://github.com/dataease/SQLBot · Nota
• https://vuldb.com/?id.348291 · Nota
• https://vuldb.com/?submit.707288 · Nota
• https://twitter.com/infoflowcloud/status/2028369917754405110 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-15597 · Aviso do Fabricante
• https://vuldb.com/?submit.707285 · Nota
• https://vuldb.com/?submit.706144 · Nota
• https://vuldb.com/?submit.707286 · Nota