A critical SQL injection vulnerability in Yonyou KSOA 9.0 permits unauthenticated remote attackers to compromise the backend database.

The application fails to properly sanitize the zpjhid parameter within the /kp/PrintZPYG.jsp file, enabling SQL injection. This flaw is exploitable by any unauthenticated attacker via a crafted GET request.

Successful exploitation grants an attacker the ability to execute arbitrary SQL queries, potentially resulting in unauthorized access to sensitive corporate data, data exfiltration, or complete system compromise. With a CVSS score of 7.3, this vulnerability represents a significant risk to confidentiality and integrity, particularly for organizations relying on KSOA for core business processes.

Immediate Action: As no official patch is currently available from the vendor, restrict access to the /kp/PrintZPYG.jsp endpoint using network-level controls or a Web Application Firewall to block requests containing suspicious SQL syntax.

Proactive Monitoring: Review web server and database logs for anomalous GET requests targeting /kp/PrintZPYG.jsp, specifically looking for indicators of SQL injection such as UNION statements, time-based delays, or unexpected character sequences.

Compensating Controls: Deploy WAF rules designed to detect and block SQL injection patterns in URL parameters, and ensure the database service account is restricted to the minimum necessary privileges to limit the blast radius of a potential compromise.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to a researcher's technical write-up on GitHub.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, organizations using Yonyou KSOA 9.0 must prioritize the implementation of compensating controls immediately. Network segmentation and strict input filtering are essential to defend against exploitation until a formal update is released by the vendor.