PT-2026-22726 · Dataease · Dataease Sqlbot

Vuldb + 1 · Publicado 2026-03-03 · Atualizado 2026-03-05 · CVE-2025-15598

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Dataease SQLBot versions up to 1.5.1

Description A flaw exists in Dataease SQLBot that relates to improper cryptographic signature verification. The issue is located within the validateEmbedded function in the backend/apps/system/middleware/auth.py file, part of the JWT Token Handler component. This allows for manipulation, potentially leading to unauthorized access. The exploit has been publicly disclosed. The complexity of the attack is considered high, and exploitability is difficult. A warning exists in the source code regarding the use of this feature.

Recommendations Versions prior to 1.5.1 should be updated. As a temporary workaround, consider disabling the validateEmbedded() function until a patch is available.

Exploit

Correção

Improper Verification of Cryptographic Signature

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-347

CWE-345

Identificadores relacionados

CVE-2025-15598

Produtos afetados

Dataease Sqlbot

Referências · 13

• 🔥 https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-JWT-Signature-Verification-Bypass.md · Exploit
• https://t.me/cveNotify/154415 · Publicação no Telegram
• https://vuldb.com/?submit.707291 · Nota
• https://twitter.com/CVEnew/status/2028774015431512360 · Publicação no Twitter
• https://t.me/CVEtracker/46193 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-15598 · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2028787010639466809 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2028775024337809482 · Publicação no Twitter
• https://vuldb.com/?ctiid.348292 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-15598 · Nota de Segurança
• https://t.me/cveNotify/153895 · Publicação no Telegram
• https://vuldb.com/?id.348292 · Nota
• https://twitter.com/cyberbivash/status/2028773056475209971 · Publicação no Twitter