CVE-2024-57707

CVE-2024-57707 is a critical code injection vulnerability (CWE-94) in DataEase version 1, enabling arbitrary code execution through the user account and password components. Assigned a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), it was published on 2025-02-07 and affects the application's authentication mechanisms, allowing attackers to inject and execute malicious code remotely.

Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation grants high-impact access, compromising confidentiality, integrity, and availability by executing arbitrary code on the affected DataEase v1 instance, potentially leading to full server takeover.

For mitigation details, refer to the advisory at https://github.com/shigophilo/CVE/blob/main/DataEase-v1-code-execute.md.