PT-2025-23671 · Dataease · Dataease

Le1Afinderph0Ebusfinder · Published 2025-06-03 · Updated 2026-04-27 · CVE-2025-49002

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.10

Description DataEase is an open source business intelligence and data visualization tool. A flaw exists in a previous patch that allows it to be bypassed through case insensitivity because the prohibited terms INIT and RUNSCRIPT are not handled regardless of case, potentially leading to remote code execution via SQL injection bypass.

Recommendations Update to version 2.10.10.

Exploit

Fix

RCE

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2025-49002

GHSA-999M-JV2P-5H34

GHSA-H7HJ-4J78-CVC7

Affected Products

Dataease

References · 11

• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-4j78-cvc7 · Exploit
• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-999m-jv2p-5h34 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49002.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-49002 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49002 · Vendor Advisory
• https://t.me/cvetracker/25326 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/2046272718010794158 · Twitter Post
• https://twitter.com/dailycve/status/1930643448631087122 · Twitter Post
• https://twitter.com/CVEnew/status/1930004332025384965 · Twitter Post
• https://t.me/CSIRT_italia/3430 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1930088113323332056 · Twitter Post