A critical code injection vulnerability in DataEase allows authenticated users to execute arbitrary commands, leading to full system compromise.

This vulnerability involves Improper Control of Generation of Code (CWE-94), which allows an authenticated attacker to inject and execute arbitrary code, resulting in high impact to confidentiality, integrity, and availability.

With a CVSS score of 8.7, this code injection flaw poses an existential risk to the host system. A successful exploit could grant an attacker full control over the application server, facilitating data theft, ransomware deployment, or complete system downtime.

Immediate Action: Update DataEase to version 2.10.24 or later immediately to patch the code injection entry point.

Proactive Monitoring: Inspect server processes and logs for unexpected execution of system commands or unauthorized modifications to the application directory.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter malicious payloads that attempt to inject executable code into application parameters.

Public Exploit Available: false

Code injection is a severe vulnerability that requires immediate remediation. All DataEase users must prioritize upgrading to version 2.10.24 to prevent potential full-system compromise and ensure the security of their data and infrastructure.