CVE-2026-1132
📋 TL;DR
This CVE describes a SQL injection vulnerability in Yonyou KSOA 9.0 that allows remote attackers to execute arbitrary SQL commands via the folderid parameter in the /kmf/edit_folder.jsp endpoint. Organizations using Yonyou KSOA 9.0 are affected, particularly those with internet-facing instances. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- Yonyou KSOA
📦 What is this software?
Ksoa by Yonyou
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover through SQL injection to RCE chaining.
Likely Case
Database information disclosure, data manipulation, or potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily weaponizable by attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block SQL injection patterns targeting the /kmf/edit_folder.jsp endpoint and folderid parameter.
Input Validation Filter
allImplement input validation to sanitize the folderid parameter, allowing only expected values.
🧯 If You Can't Patch
- Network segmentation: Isolate Yonyou KSOA systems from internet access and restrict internal access.
- Monitor and alert: Implement robust logging and alerting for SQL injection attempts on the vulnerable endpoint.
🔍 How to Verify
Check if Vulnerable:
Test the /kmf/edit_folder.jsp endpoint with SQL injection payloads in the folderid parameter. Use tools like sqlmap with caution: sqlmap -u 'http://target/kmf/edit_folder.jsp?folderid=1' --batchCheck Version:
Check application version through admin interface or configuration files specific to Yonyou KSOA.Verify Fix Applied:
Re-test with SQL injection payloads after implementing workarounds to ensure they are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed login attempts following SQL injection patterns
- Requests to /kmf/edit_folder.jsp with suspicious folderid values
Network Indicators:
- HTTP GET requests to /kmf/edit_folder.jsp containing SQL keywords in parameters
- Unusual database traffic from application servers
SIEM Query:
source="web_logs" AND uri_path="/kmf/edit_folder.jsp" AND (query_string="*folderid=*SELECT*" OR query_string="*folderid=*UNION*" OR query_string="*folderid=*OR*1=1*")