A critical SQL injection vulnerability in Yonyou KSOA 9.0 allows unauthenticated remote attackers to manipulate backend database queries, posing a severe risk to system integrity and data confidentiality.

This is a SQL injection (CWE-89) vulnerability occurring in the /worksheet/del_user.jsp file. An unauthenticated attacker can supply malicious input via the id HTTP GET parameter, which is concatenated into a SQL statement without proper sanitization or parameterization.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary SQL commands against the backend Microsoft SQL Server database. This can lead to unauthorized data exfiltration, modification of sensitive records, or potential administrative compromise of the database server, significantly impacting the confidentiality and integrity of business operations. Given the CVSS score of 7.3, this flaw represents a significant risk to organizational security.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the affected /worksheet/del_user.jsp endpoint using firewall rules or network segmentation.

Proactive Monitoring: Review web server and database logs for anomalous request patterns, specifically looking for SQL syntax characters or time-based delay commands in the id parameter.

Compensating Controls: Deploy or update Web Application Firewall (WAF) signatures to detect and block common SQL injection payloads targeting the identified parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked research write-up.

The presence of a public proof-of-concept necessitates immediate defensive action to prevent potential exploitation. Because the vendor has not provided a patch, administrators must prioritize mitigating the exposure of the vulnerable endpoint. Implementing strict input validation or using a WAF to filter malicious traffic is critical until an official security update is released and applied.