A critical SQL injection vulnerability in Yonyou KSOA 9.0 allows unauthenticated remote attackers to compromise backend database integrity and confidentiality.

This is a SQL injection vulnerability (CWE-89) located in the /worksheet/agent_worksdel.jsp file. The application fails to sanitize the id HTTP GET parameter before concatenating it into a SQL query, allowing an unauthenticated attacker to inject malicious commands.

Successful exploitation of this vulnerability grants an attacker the ability to execute unauthorized SQL queries against the backend Microsoft SQL Server database. This can lead to full disclosure of sensitive organizational data, unauthorized modification or deletion of records, and potential escalation to administrative control over the database environment. With a CVSS score of 7.3, this flaw presents a significant risk to the confidentiality, integrity, and availability of business operations.

Immediate Action: As there is no official patch available, administrators must restrict network access to the affected endpoint or disable the vulnerable /worksheet/agent_worksdel.jsp file if it is not required for business operations.

Proactive Monitoring: Review web server and database logs for suspicious HTTP GET requests to the identified vulnerable path, specifically looking for SQL syntax patterns, time-based delay commands, or unusual character sequences in the id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the id parameter. Ensure that the database user account associated with the web application follows the principle of least privilege to limit the scope of potential damage.

Public Exploit Available: Yes, a functional proof-of-concept is available via the researcher's published write-up on GitHub.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability poses an immediate risk to any exposed Yonyou KSOA 9.0 instances. Organizations should prioritize isolating the affected component and implementing robust WAF filtering to prevent exploitation until a formal security update is released by the vendor.