A remote SQL injection vulnerability in Yonyou KSOA 9.0 exposes the backend database to unauthorized manipulation and potential data exfiltration.

This is a SQL injection flaw (CWE-89) triggered via the ID parameter within the /worksheet/del_work.jsp file. The vulnerability is remotely exploitable by unauthenticated attackers.

Successful exploitation allows an attacker to execute arbitrary SQL commands against the backend database, potentially leading to the unauthorized disclosure or modification of sensitive enterprise data. Given the CVSS score of 7.3, this represents a significant risk to data integrity and confidentiality that requires immediate attention to prevent unauthorized access to corporate information.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the /worksheet/del_work.jsp endpoint or disable the affected module entirely if it is not business critical.

Proactive Monitoring: Monitor web server logs for suspicious HTTP GET requests targeting the del_work.jsp file, specifically looking for payloads containing SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming traffic containing SQL injection patterns directed at the KSOA application.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the technical write-up provided in the referenced GitHub issue.

Due to the availability of a public proof-of-concept and the lack of a vendor-provided security update, this vulnerability presents an elevated risk to the organization. Security teams must prioritize implementing network-level blocks or WAF rules to mitigate the threat until the vendor releases a formal patch for the affected KSOA component.