CVE-2025-56819

CRITICALNuclei

Datart v1.0.0-rc.3 - Remote Code Execution

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-56819 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 24, 2025 · Source: CVE List

Proofs of concept

1

Repository PoCs

GitHubxyyzxc/CVE-2025-56819Repository PoCby xyyzxc2Exploit1 file

798 B

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README.md file that documents a remote code execution vulnerability in Datart v.1.0.0-rc.3. It provides a complete HTTP POST request to the /api/v1/data-provider/test endpoint, which includes a malicious JDBC URL containing an INIT parameter with a CREATE ALIAS and CALL statement to execute an arbitrary OS command ('touch /tmp/test1'). This constitutes a fully functional exploit payload.

Backdoor review

No backdoor observed in reviewed code

The artifact is a README.md file describing payload withheld, a vulnerability in Datart. It contains a proof-of-concept HTTP request demonstrating how an attacker could exploit the vulnerability to achieve remote code execution on a target Datart instance. The payload is a standard exploit demonstration for the described CVE, targeting the stated vulnerable application, and contains no concealed backdoor, deceptive payload, or behavior targeting the person reviewing the PoC.

ClassificationExploit
Model confidence95%
AuthenticationUnknown
LanguagesMarkdownJSONSQL
Target softwareDatart
Attack typesRemote Code ExecutionSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, ready-to-use HTTP request with a malicious JDBC URL that exploits the INIT parameter to achieve arbitrary code execution. This is executable exploit code, not merely a scanner or a writeup.

README.md:5-25

Requirements

  • Target must be running Datart v.1.0.0-rc.3 with the /api/v1/data-provider/test endpoint exposed.README.md:2README.md:5
  • The target must have an H2 database driver available and the JDBC connection must be processed without input sanitization.README.md:14-15

Observed behavior

  • Sends a crafted HTTP POST request to the /api/v1/data-provider/test endpoint with a JSON body containing a JDBC connection configuration.README.md:5-25
  • The JDBC URL includes an INIT parameter that creates a Java alias 'EXEC' and calls it to execute the OS command 'touch /tmp/test1'.README.md:15
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Cve Reference
Payload withheldThe artifact documents a known vulnerability in Datart v.1.0.0-rc.3, consistent with the supplied CVE context.README.md:1-2
Exploit Payload
Payload withheldThe payload demonstrates the described vulnerability by using the H2 database INIT parameter to create an alias that executes an OS command. This is a standard proof-of-concept for the stated CVE, targeting the vulnerable application, not the reviewer.README.md:5-25
Review boundaries

What the analysis did not establish

  • Only one file (README.md) was provided; no other source code or configuration files were included.
  • The evidence does not confirm whether the exploit was successfully executed or tested.
  • The CVE description mentions 'remote attacker' but the artifact does not specify authentication requirements.
  • Review is limited to the supplied text of README.md; no other files from the repository were provided or analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Nuclei templates

1
ProjectDiscoveryCRITICALDatart v1.0.0-rc.3 - Remote Code ExecutionCVSS 9.8

Datart v1.0.0-rc.3 contains a vulnerability that allows remote attackers to execute arbitrary code via INIT connection parameters.

WeaknessesCWE-78
AuthorsRedmomn
Template tagscvecve2025datartrceh2jdbcoastauthentication
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:running-elephant:datart:1.0.0:rc3:*:*:*:*:*:*
Shodan: title:"Datart"
FOFA: title="Datart"
https://github.com/advisories/GHSA-623q-jr4p-f87c https://github.com/xyyzxc/CVE-2025-56819 https://nvd.nist.gov/vuln/detail/CVE-2025-56819

Source: ProjectDiscovery

References

4