This vulnerability affects the execute function of the REST Endpoint component in xianrendzw EasyReport versions up to 2.0.17.0522_Beta. An attacker can remotely manipulate the reportParams argument to perform SQL injection, potentially allowing unauthorized database queries or modifications. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. The vendor has not issued any advisory or patch, and no official remediation is currently available.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database via the REST Endpoint, potentially leading to unauthorized data access or modification. However, the impact is rated as low for confidentiality, integrity, and availability, indicating limited or partial compromise. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing application-layer input validation or web application firewall (WAF) rules to detect and block suspicious SQL injection attempts targeting the reportParams argument. Monitor for updates from the vendor regarding official patches or mitigations.