CVE-2025-15421
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary SQL commands via the ID parameter in the /worksheet/agent_worksadd.jsp endpoint of Yonyou KSOA 9.0. This can lead to unauthorized data access, modification, or deletion. Organizations running Yonyou KSOA 9.0 with the vulnerable component exposed are affected.
💻 Affected Systems
- Yonyou Space-Time Enterprise Information Integration KSOA Platform
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data exfiltration, modification, or deletion; potential for lateral movement to other systems; possible system takeover if database privileges allow command execution.
Likely Case
Unauthorized access to sensitive business data stored in the database, including customer information, financial records, or proprietary data.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation preventing exploitation attempts.
🎯 Exploit Status
The exploit is publicly available and requires minimal technical skill to execute. No authentication is required to access the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Monitor vendor channels for updates. Consider upgrading to a newer version if available.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the /worksheet/agent_worksadd.jsp endpoint and ID parameter
Network Access Control
allRestrict access to the vulnerable endpoint using network segmentation or access control lists
🧯 If You Can't Patch
- Implement input validation and parameterized queries in the application code
- Deploy a web application firewall with SQL injection detection rules
🔍 How to Verify
Check if Vulnerable:
Test the /worksheet/agent_worksadd.jsp endpoint with SQL injection payloads in the ID parameter (e.g., ID=1' OR '1'='1)Check Version:
Check application version through admin interface or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and that proper input validation is implemented📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple requests to /worksheet/agent_worksadd.jsp with suspicious ID parameter values
- Database query errors containing SQL syntax
Network Indicators:
- HTTP GET requests to /worksheet/agent_worksadd.jsp containing SQL keywords in parameters
- Unusual database connection patterns from application server
SIEM Query:
source="web_logs" AND uri="/worksheet/agent_worksadd.jsp" AND (param="ID" AND value CONTAINS "'" OR value CONTAINS "OR" OR value CONTAINS "UNION" OR value CONTAINS "SELECT")🔗 References
- https://github.com/master-abc/cve/blob/main/Yonyou%20Space-Time%20Enterprise%20Information%20Integration%20KSOA%20Platformworksheetagent_worksadd.jsp%20SQL%20injection.md
- https://vuldb.com/?ctiid.339343
- https://vuldb.com/?id.339343
- https://vuldb.com/?submit.721324
- https://vuldb.com/?submit.721527
- https://github.com/master-abc/cve/blob/main/Yonyou%20Space-Time%20Enterprise%20Information%20Integration%20KSOA%20Platformworksheetagent_worksadd.jsp%20SQL%20injection.md
