CVE-2026-1120
📋 TL;DR
This CVE describes a SQL injection vulnerability in Yonyou KSOA 9.0 that allows remote attackers to execute arbitrary SQL commands via the ID parameter in the /worksheet/del_work.jsp endpoint. Organizations using Yonyou KSOA 9.0 are affected, particularly those with internet-facing instances. The vulnerability can lead to data theft, modification, or complete system compromise.
💻 Affected Systems
- Yonyou KSOA
📦 What is this software?
Ksoa by Yonyou
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, data destruction, or full system takeover via SQL injection to RCE escalation.
Likely Case
Unauthorized data access, data manipulation, or privilege escalation within the database.
If Mitigated
Limited impact due to network segmentation, WAF protection, or minimal database privileges.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily weaponizable by attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Contact Yonyou support for updates and consider upgrading to a newer version if available.
🔧 Temporary Workarounds
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns targeting the /worksheet/del_work.jsp endpoint.
URL Blocking
allBlock access to /worksheet/del_work.jsp at network perimeter or load balancer.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Yonyou KSOA instances from sensitive networks.
- Deploy database monitoring and alerting for unusual SQL queries originating from the application.
🔍 How to Verify
Check if Vulnerable:
Test the /worksheet/del_work.jsp endpoint with SQL injection payloads in the ID parameter. Use tools like sqlmap with caution: sqlmap -u "http://target/worksheet/del_work.jsp?ID=1" --batchCheck Version:
Check Yonyou KSOA version through administrative interface or configuration files.Verify Fix Applied:
Verify that SQL injection attempts no longer succeed and that the endpoint is either patched or blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed requests to /worksheet/del_work.jsp with SQL patterns
Network Indicators:
- HTTP GET requests to /worksheet/del_work.jsp containing SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/worksheet/del_work.jsp" AND (param="ID" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|exec|--|#)")