An unauthenticated SQL injection vulnerability in DataEase versions prior to 2.10.20 allows remote attackers to execute arbitrary SQL commands, posing a severe risk to data confidentiality and integrity.

This is an SQL injection flaw (CWE-89) located in the /de2api/datasource/previewData endpoint. The application fails to properly sanitize or parameterize the table parameter, enabling unauthenticated users to inject malicious SQL statements directly into the backend database.

The ability for an unauthenticated attacker to manipulate database queries can lead to full unauthorized access to sensitive information, data modification, or complete database compromise. Given the CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent potential data breaches or service disruption.

Immediate Action: Upgrade DataEase to version 2.10.20 or later to apply the necessary input sanitization and parameterization fixes.

Proactive Monitoring: Review application access logs for anomalous requests to the /de2api/datasource/previewData endpoint, specifically looking for SQL syntax patterns or unexpected character sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP requests targeting the affected API endpoint.

Public Exploit Available: Unknown.

This vulnerability presents a significant security risk due to its accessibility and the potential for total compromise of the database layer. IT administrators must prioritize the update to version 2.10.20 immediately to neutralize the threat. In environments where an immediate patch is not feasible, implement strict network-level access controls or WAF filtering to restrict access to the affected API endpoint.