SQL Injection Vulnerability in SQLBot by DataEase

CVE-2026-32950

What is CVE-2026-32950?

SQLBot, an intelligent data query system developed by DataEase, has a significant SQL Injection vulnerability present in versions before 1.7.0. This flaw allows authenticated users to execute remote commands on the backend server without necessary privileges. The vulnerability stems from unsanitized concatenation of Excel Sheet names into PostgreSQL table names and flawed embedding of these names into SQL statements. Attackers can exploit this by uploading crafted files to bypass limitations and insert malicious commands into the SQL execution context, leading to potential database takeover and exposure of sensitive files. It is crucial for users to update to version 1.7.0 or later to mitigate this risk.

References