CVE-2026-1122
📋 TL;DR
This CVE describes a SQL injection vulnerability in Yonyou KSOA 9.0 that allows remote attackers to execute arbitrary SQL commands via the ID parameter in the /worksheet/work_info.jsp endpoint. Organizations using Yonyou KSOA 9.0 are affected, particularly those with internet-facing instances. The vulnerability enables unauthorized database access and potential data manipulation.
💻 Affected Systems
- Yonyou KSOA
📦 What is this software?
Ksoa by Yonyou
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover through privilege escalation.
Likely Case
Unauthorized data access, extraction of sensitive information, and potential lateral movement within the database.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider workarounds or alternative solutions.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the /worksheet/work_info.jsp endpoint
# WAF-specific rules vary by vendor
Input Validation Filter
allAdd input validation to sanitize the ID parameter before processing
# Implementation depends on application framework
🧯 If You Can't Patch
- Isolate the affected system from internet access and restrict internal network access
- Implement strict database permissions and monitor for unusual SQL queries
🔍 How to Verify
Check if Vulnerable:
Test the /worksheet/work_info.jsp endpoint with SQL injection payloads in the ID parameterCheck Version:
Check Yonyou KSOA version through administrative interface or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts from single IP
- Requests to /worksheet/work_info.jsp with suspicious ID parameters
Network Indicators:
- Unusual outbound database connections
- HTTP requests with SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/worksheet/work_info.jsp" AND (param="ID" AND value CONTAINS "' OR '1'='1" OR value CONTAINS "UNION SELECT" OR value CONTAINS "--")