Threats tagged 'ghsa-54vg-4hhr-cfwh'

A SQL injection vulnerability exists in DataEase versions up to 2.10.27 and 3.1.0 in the ExtWhere2Str.extWhere2sqlOjb function of the Chart Data Handler component. This flaw allows remote attackers to manipulate the operator argument, leading to SQL injection. The vulnerability has been publicly disclosed and exploit code may be available. Upgrading to version 3.2.0 addresses the issue by validating the compound operator and using fixed AND/OR keywords instead of concatenating user input into SQL queries.