CVE-2026-1121
📋 TL;DR
This CVE describes a SQL injection vulnerability in Yonyou KSOA 9.0 that allows remote attackers to execute arbitrary SQL commands via the ID parameter in the /worksheet/del_workplan.jsp endpoint. Organizations using Yonyou KSOA 9.0 are affected, particularly those with internet-facing instances. The vulnerability can lead to data theft, modification, or complete system compromise.
💻 Affected Systems
- Yonyou KSOA
📦 What is this software?
Ksoa by Yonyou
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation, and potential remote code execution on the underlying server.
Likely Case
Unauthorized data access, modification, or deletion of database contents, potentially affecting business operations and sensitive information.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
The exploit has been made public and can be launched remotely without authentication. Attackers can easily craft malicious requests to exploit this vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider implementing workarounds or migrating to a supported version if available.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block SQL injection patterns targeting the /worksheet/del_workplan.jsp endpoint and ID parameter.
Input Validation Filter
allImplement server-side input validation to sanitize the ID parameter, allowing only expected data types and formats.
🧯 If You Can't Patch
- Network segmentation: Isolate Yonyou KSOA systems from internet access and restrict internal access to authorized users only.
- Database hardening: Implement least privilege database accounts, enable logging, and monitor for suspicious SQL queries.
🔍 How to Verify
Check if Vulnerable:
Test the endpoint /worksheet/del_workplan.jsp with SQL injection payloads in the ID parameter (e.g., ID=1' OR '1'='1). Monitor for error responses or unexpected behavior.Check Version:
Check application documentation or interface for version information. Yonyou KSOA 9.0 is specifically affected.Verify Fix Applied:
After implementing workarounds, retest with SQL injection payloads to ensure they are blocked or sanitized. Verify WAF logs show blocked attempts.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple requests to /worksheet/del_workplan.jsp with suspicious ID parameters
- Database query logs showing unexpected SQL commands
Network Indicators:
- HTTP GET requests to /worksheet/del_workplan.jsp containing SQL keywords (e.g., UNION, SELECT, OR) in the ID parameter
- Unusual traffic patterns to the vulnerable endpoint
SIEM Query:
source="web_logs" AND uri="/worksheet/del_workplan.jsp" AND (query_string CONTAINS "UNION" OR query_string CONTAINS "SELECT" OR query_string CONTAINS "OR")