PT-2025-34686

CVE-2025-57772

Published

2025-08-25

Updated

2025-08-27

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.12

Description: DataEase is an open-source business intelligence and data visualization tool. Prior to version 2.10.12, a H2 JDBC Remote Code Execution (RCE) bypass exists. If the JDBC URL meets specific criteria, the getJdbcUrl method returns the JdbcUrl parameter, bypassing H2’s filtering logic and allowing the specification of the H2 driver for the JDBC connection via "driver":"org.h2.Driver".

Recommendations: Update DataEase to version 2.10.12 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Fushuling

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers