Executive brief
EasyReport, a web-based data reporting and visualization tool, is vulnerable to a security flaw in its report generation component. An attacker with basic user permissions can inject malicious database commands through report parameters. This could allow an unauthorized user to view sensitive data, modify records, or disrupt the reporting service.
Technical details
A stored SQL injection vulnerability exists in the REST Endpoint component of EasyReport. The flaw resides in the 'execute' function where 'reportParams' are processed. The root cause is the use of MyBatis string concatenation (${} syntax) or Java string concatenation instead of parameterized queries (#{} syntax) when handling stored report parameters. A remote attacker with low privileges can submit a malicious report configuration that, when executed during report generation, triggers the injection. This allows for unauthorized database queries, potentially leading to data exfiltration or modification. No official patch has been released by the vendor.
Affected products
- xianrendzw EasyReport up to 2.0.17.0522_Beta
Timeline
- 2026-05-26: disclosed: Initial public disclosure via VulDB and GitHub bug report.
- 2026-05-26: advisory: CVE-2026-9524 published.