A SQL injection vulnerability in Yonyou U8cloud 5.x allows remote, authenticated attackers to execute unauthorized database queries and potentially exfiltrate sensitive information.

The application fails to properly sanitize the operator argument within the /u8cloud/openapi/so.saleorder.sendaudit endpoint, enabling SQL injection. This vulnerability requires the attacker to be authenticated, as indicated by the CVSS vector's PR:L (Privileges Required: Low) designation.

Successful exploitation allows an attacker to execute arbitrary SQL commands against the backend database. This can lead to the unauthorized disclosure of sensitive enterprise data, potential modification of business records, or total database compromise. While the CVSS score is 6.3, the presence of a public proof-of-concept and the potential for significant data leakage necessitate prompt attention.

Immediate Action: Since no official vendor patch is currently available, prioritize restricting network access to the affected OpenAPI endpoint to authorized internal sources only.

Proactive Monitoring: Review web server and application access logs for anomalous POST requests directed at /u8cloud/openapi/so.saleorder.sendaudit, specifically monitoring for SQL syntax patterns or unexpected character strings in the operator field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection attempts targeting the vulnerable parameter. Ensure all database queries are validated and sanitized at the application level where possible.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security research documented in the referenced GitHub repository.

Given the availability of functional proof-of-concept code and the vendor's lack of response, this vulnerability poses a credible risk to the integrity and confidentiality of your ERP data. Organizations should immediately implement the recommended compensating controls and restrict access to the vulnerable endpoint until an official security update is released by Yonyou.