DataEase 2.4.0 to 2.5.0 allows remote attackers to obtain sensitive information via a crafted request to /de2api/engine/getEngine;.js, which results in the disclosure of database configuration details such as username, password, and port.