Executive brief
UReport2 is a Java-based reporting engine used to design and generate complex business reports. A security flaw in its data preview component allows unauthorized individuals to execute arbitrary database commands without a password. This could lead to the theft of sensitive company data, the deletion of database records, or full control over the underlying server.
Technical details
A critical SQL injection vulnerability exists in the /ureport/datasource/previewData endpoint of UReport2 v2.2.9 and earlier. The component fails to authenticate requests and lacks effective filtering or validation of the 'sql' parameter in POST requests. An unauthenticated remote attacker can exploit this by sending crafted HTTP requests to execute arbitrary SQL statements against the backend database. Depending on database permissions (such as FILE privileges in MySQL), this can be escalated to Remote Code Execution (RCE) via the creation of WebShells or User Defined Functions (UDF).
Affected products
- BSTek (youseries) UReport2 2.2.9 and earlier
Timeline
- 2026-07-16: disclosed: Vulnerability published to NVD and researcher PoC released.