CVE-2025-15424
📋 TL;DR
This CVE describes a SQL injection vulnerability in Yonyou KSOA 9.0 through the /worksheet/agent_worksdel.jsp endpoint. Attackers can manipulate the ID parameter to execute arbitrary SQL commands, potentially compromising database integrity and confidentiality. Organizations using Yonyou KSOA 9.0 are affected, especially those with internet-facing instances.
💻 Affected Systems
- Yonyou Space-Time Enterprise Information Integration KSOA Platform
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via SQL injection to RCE chaining
Likely Case
Unauthorized data access, data exfiltration, and potential privilege escalation within the database
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place
🎯 Exploit Status
Public proof-of-concept available, remote exploitation possible without authentication
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor was contacted but did not respond. Consider workarounds or alternative solutions.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting /worksheet/agent_worksdel.jsp endpoint
Input Validation Filter
allAdd input validation to sanitize ID parameter before processing
🧯 If You Can't Patch
- Implement network segmentation to restrict access to KSOA instances
- Deploy database monitoring to detect SQL injection attempts
🔍 How to Verify
Check if Vulnerable:
Test the /worksheet/agent_worksdel.jsp endpoint with SQL injection payloads in the ID parameterCheck Version:
Check KSOA version through administrative interface or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts following SQL injection patterns
- HTTP requests to /worksheet/agent_worksdel.jsp with suspicious ID parameters
Network Indicators:
- Unusual outbound database connections from web servers
- HTTP traffic patterns matching known SQL injection payloads
SIEM Query:
source="web_logs" AND uri="/worksheet/agent_worksdel.jsp" AND (param="ID" AND value MATCHES "(?i)(union|select|insert|delete|update|drop|exec|sleep|waitfor|benchmark)")🔗 References
- https://github.com/master-abc/cve/blob/main/Yonyou%20Space-Time%20Enterprise%20Information%20Integration%20KSOA%20Platformworksheetagent_worksdel.jsp%20SQL%20injection.md
- https://github.com/master-abc/cve/blob/main/Yonyou%20Space-Time%20Enterprise%20Information%20Integration%20KSOA%20Platformworksheetagent_worksdel.jsp%20SQL%20injection.md#vulnerability-details-and-poc
- https://vuldb.com/?ctiid.339346
- https://vuldb.com/?id.339346
- https://vuldb.com/?submit.721348
- https://vuldb.com/?submit.721526
- https://github.com/master-abc/cve/blob/main/Yonyou%20Space-Time%20Enterprise%20Information%20Integration%20KSOA%20Platformworksheetagent_worksdel.jsp%20SQL%20injection.md#vulnerability-details-and-poc
