A critical SQL injection vulnerability in Yonyou KSOA 9.0 allows unauthenticated remote attackers to execute arbitrary database queries, posing a severe risk to system data and integrity.

This is a SQL injection vulnerability (CWE-89) located in the /worksheet/work_update.jsp file. An unauthenticated remote attacker can inject malicious SQL payloads via the Report GET parameter, which the application fails to sanitize before processing.

Successful exploitation allows unauthorized access to the underlying database, potentially leading to sensitive data exfiltration, unauthorized modification of records, or complete system compromise. With a CVSS score of 7.3, this flaw represents a significant risk to confidentiality and integrity, particularly for business-critical enterprise management systems.

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict network access to the vulnerable /worksheet/work_update.jsp endpoint or disable the affected module entirely if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous GET requests targeting the work_update.jsp file, specifically looking for SQL-related patterns like WAITFOR DELAY, UNION, or SELECT statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests containing SQL injection patterns directed at the /worksheet/work_update.jsp endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the referenced GitHub repository.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability must be treated as a high priority. Organizations should immediately implement WAF filtering and internal network segmentation to isolate the KSOA instance until a formal security update is released by Yonyou.