Yonyou KSOA 9.0 is susceptible to an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate back-end database queries.

This vulnerability is a SQL injection flaw (CWE-89) located in the HTTP GET parameter handler of the worksheet/del_workplan.jsp component. The vulnerability is exploitable by unauthenticated remote attackers via the ID argument.

Successful exploitation of this SQL injection vulnerability could allow an attacker to gain unauthorized access to sensitive data stored within the back-end database. With a CVSS score of 7.3, this flaw poses a high risk to data confidentiality and integrity, potentially leading to unauthorized information disclosure or database compromise.

Immediate Action: As no official patch is currently available from the vendor, restrict access to the /worksheet/del_workplan.jsp endpoint at the network or web server level to block all external traffic.

Proactive Monitoring: Monitor web server logs for suspicious HTTP GET requests containing SQL syntax or unusual characters in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting this specific endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability disclosure.

Given the availability of a public proof-of-concept and the lack of vendor responsiveness, organizations utilizing Yonyou KSOA 9.0 must treat this as a high-priority risk. Immediate implementation of perimeter controls or WAF filtering is necessary to prevent unauthorized database access until a formal vendor-supplied security update is released.