The vulnerability in xianrendzw EasyReport up to version 2.0.17.0522_Beta exists in the DesignerController.java file's execSqlText and previewSqlText functions. It arises from improper neutralization of special elements used in a template engine when processing the sqlText argument. This can be exploited remotely. The issue was reported early to the project, but no fix or response has been provided. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability.

An attacker can remotely exploit this vulnerability by manipulating the sqlText parameter, potentially leading to injection or template engine exploitation. The exact impact is limited as per the CVSS vector, but it could allow partial compromise of data or execution context within the affected component. No confirmed active exploitation in the wild is reported.

No official patch or fix has been released by the vendor. Users should monitor the vendor's communications for updates. Until a fix is available, avoid exposing the vulnerable SQL Preview Endpoint to untrusted networks or restrict access to trusted users only. Validate and sanitize inputs to the sqlText parameter where possible to reduce risk.