Authenticated code execution via Velocity template evaluation

Code injection in xianrendzw EasyReport through 2.0.17.0522_Beta allows remote authenticated users to execute code via sqlText. In the SQL Preview Endpoint, DesignerController.execSqlText and previewSqlText pass attacker-controlled sqlText through getSqlText into VelocityUtils.parse, which calls Velocity.evaluate while exposing DateUtils.class, StringUtils.class, and Calendar in the template context. Exploitation requires Shiro-authenticated access and the low report.designer:view permission on /rest/** routes, and yields code execution in the JVM hosting the application.