A critical SQL injection vulnerability in Yonyou KSOA 9.0 exposes the backend database to unauthorized access and potential administrative compromise by unauthenticated remote attackers.

This vulnerability is a SQL injection flaw (CWE-89) located in the /worksheet/agent_worksadd.jsp file. The application fails to sanitize the id HTTP GET parameter before including it in database queries, allowing an unauthenticated attacker to manipulate backend SQL execution.

The exploitation of this vulnerability poses a severe threat to the confidentiality, integrity, and availability of the affected system. An attacker can achieve unauthorized database access, leak sensitive information, modify data, or potentially gain administrative control over the database server. With a CVSS score of 7.3, this flaw represents a significant risk to the business, as it allows for remote exploitation without the need for valid user credentials.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected /worksheet/agent_worksadd.jsp endpoint at the network or firewall level.

Proactive Monitoring: Review web server and database access logs for anomalous patterns, specifically looking for SQL injection syntax such as WAITFOR DELAY, UNION SELECT, or other database-specific commands targeting the id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts directed at the identified vulnerable endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked research write-up on GitHub.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, organizations running Yonyou KSOA 9.0 must treat this as a high-priority risk. Administrators should immediately implement compensating controls, such as strict WAF filtering, to block malicious requests. Until a vendor-supplied update is released and verified, assume that this endpoint is actively being probed by malicious actors.