CVE-2026-1123
📋 TL;DR
This CVE describes a SQL injection vulnerability in Yonyou KSOA 9.0's /worksheet/work_mod.jsp file via the ID parameter in HTTP GET requests. Attackers can remotely exploit this to execute arbitrary SQL commands on the database. Organizations using Yonyou KSOA 9.0 are affected.
💻 Affected Systems
- Yonyou KSOA
📦 What is this software?
Ksoa by Yonyou
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via SQL injection to RCE chaining.
Likely Case
Database information disclosure, data manipulation, or potential privilege escalation through SQL injection.
If Mitigated
Limited impact if proper input validation, WAF rules, and database permissions are in place.
🎯 Exploit Status
Exploit code is publicly available on GitHub, making this easily weaponizable. The vulnerability requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
WAF Rule Implementation
allDeploy Web Application Firewall rules to block SQL injection patterns targeting the /worksheet/work_mod.jsp endpoint.
# WAF rule example: Block requests with SQL injection patterns in ID parameter
# ModSecurity rule: SecRule ARGS:id "@detectSQLi" "id:1001,phase:2,deny,status:403"
URL Rewrite/Block
allBlock access to the vulnerable endpoint using web server configuration or network filtering.
# Apache: RewriteRule ^/worksheet/work_mod\.jsp$ - [F]
# Nginx: location = /worksheet/work_mod.jsp { return 403; }
# IIS: <rule name="Block work_mod.jsp">
# <match url="^worksheet/work_mod\.jsp" />
# <action type="AbortRequest" />
# </rule>
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in the application code
- Deploy network segmentation to isolate the KSOA system and restrict access to necessary users only
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with SQL injection payloads: curl 'http://target/worksheet/work_mod.jsp?ID=1' AND '1'='1'Check Version:
Check Yonyou KSOA version through admin interface or configuration filesVerify Fix Applied:
Test with the same SQL injection payloads after implementing workarounds - should return error or blocked response📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /worksheet/work_mod.jsp with SQL keywords in ID parameter
- Database error messages in application logs
- Unusual database queries from application user
Network Indicators:
- HTTP traffic to /worksheet/work_mod.jsp with SQL injection patterns in URL parameters
- Outbound database connections from web server with unusual queries
SIEM Query:
source="web_logs" AND url="/worksheet/work_mod.jsp" AND (query="*SELECT*" OR query="*UNION*" OR query="*OR*1=1*")