A critical SQL injection vulnerability in Yonyou KSOA 9.0 exposes the application to unauthorized database access and potential system compromise by unauthenticated remote attackers.

The application fails to sanitize the Report parameter within the /worksheet/work_edit.jsp file before incorporating it into SQL queries. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands, resulting in a classic SQL injection vulnerability.

Successful exploitation of this vulnerability allows an attacker to bypass security controls to read, modify, or delete sensitive data stored in the backend database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity. If the database service account is overprivileged, an attacker could potentially achieve deeper system access, leading to unauthorized data exfiltration or service disruption, which poses a severe threat to business continuity.

Immediate Action: As no official vendor patch is currently available, restrict network access to the affected /worksheet/work_edit.jsp endpoint using firewall rules or Access Control Lists to prevent external reachability.

Proactive Monitoring: Review web server and database logs for anomalous input patterns, specifically looking for SQL syntax characters (e.g., quotes, semicolons, or comment indicators) within the Report parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the identified parameter.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the security researcher's technical write-up linked in the CVE references.

The presence of a publicly available proof-of-concept, combined with the unauthenticated nature of this vulnerability, makes it a high priority for remediation. Organizations using Yonyou KSOA 9.0 must implement immediate network-level restrictions to prevent unauthorized access to the vulnerable endpoint. Until the vendor releases a security update, continuous monitoring for exploitation attempts is essential to detect and block potential intrusion attempts.