Dataease H2 JDBC Connection Remote Code Execution

DataEase, a business intelligence tool, allows authenticated users to execute arbitrary code on the server through a malicious JDBC database connection. This means someone with login access can take complete control of the system.

Authenticated users can achieve remote code execution by crafting a malicious JDBC connection string in the backend database link configuration. The vulnerability exists in DataEase versions prior to 2.10.8 and requires valid authentication credentials as a precondition; successful exploitation grants arbitrary code execution on the server with application privileges.