CVE-2026-1177
📋 TL;DR
This SQL injection vulnerability in Yonyou KSOA 9.0 allows remote attackers to execute arbitrary SQL commands via the folderid parameter in the /kmf/save_folder.jsp endpoint. Organizations using Yonyou KSOA 9.0 are affected, particularly those with internet-facing instances. The vulnerability is publicly exploitable with available proof-of-concept code.
💻 Affected Systems
- Yonyou KSOA
📦 What is this software?
Ksoa by Yonyou
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover through SQL injection escalation techniques.
Likely Case
Unauthorized data access, extraction of sensitive information from the database, and potential lateral movement within the network.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit code is publicly available on GitHub. Remote exploitation is confirmed. The vendor has not responded to disclosure attempts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Monitor Yonyou vendor channels for updates. Consider upgrading to a newer version if available.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the /kmf/save_folder.jsp endpoint and folderid parameter.
Input Validation Filter
allAdd server-side input validation to reject malicious SQL patterns in the folderid parameter.
🧯 If You Can't Patch
- Block external access to /kmf/save_folder.jsp at network perimeter or load balancer
- Implement strict network segmentation to isolate Yonyou KSOA systems from critical assets
🔍 How to Verify
Check if Vulnerable:
Test the /kmf/save_folder.jsp endpoint with SQL injection payloads in the folderid parameter. Monitor for database errors or unexpected responses.Check Version:
Check Yonyou KSOA version through administrative interface or configuration files (specific command depends on deployment).Verify Fix Applied:
Verify that SQL injection attempts no longer succeed and that proper input validation is implemented.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple requests to /kmf/save_folder.jsp with suspicious parameters
- Database query errors containing SQL injection patterns
Network Indicators:
- HTTP GET requests to /kmf/save_folder.jsp containing SQL keywords in parameters
- Unusual database connection patterns from application servers
SIEM Query:
source="web_logs" AND uri="/kmf/save_folder.jsp" AND (param="folderid" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "' OR '")