This vulnerability in xianrendzw EasyReport involves improper neutralization of special elements in a template engine within the execSqlText and previewSqlText functions of the DesignerController.java file. The flaw allows remote attackers to manipulate the sqlText argument, potentially leading to injection or template-related attacks. The vulnerability affects versions up to 2.0.17.0522_Beta. The project was notified early but has not issued a fix or official response. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, and limited confidentiality, integrity, and availability impacts. Exploit code is publicly available, but no known active exploitation has been reported.

The vulnerability allows remote attackers to manipulate the sqlText argument in the SQL Preview Endpoint, potentially enabling injection or template engine exploitation. This could lead to partial compromise of confidentiality, integrity, and availability of the affected system. However, the impact is limited as indicated by the CVSS vector, and no active exploitation in the wild has been observed.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor's channels for updates and consider implementing temporary mitigations such as input validation or restricting access to the affected endpoint until a patch is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.