PT-2026-3390 · Yonyou · Yonyou Ksoa
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Yonyou KSOA version 9.0
Description
A flaw exists in Yonyou KSOA 9.0 related to the HTTP GET Parameter Handler. Specifically, the manipulation of the
ID parameter in a request to the '/worksheet/work info.jsp' file can lead to a SQL injection condition. This issue can be exploited remotely. The exploit for this issue has been publicly disclosed.Recommendations
Versions prior to 9.0 should be used.
Exploit
Fix
SQL injection
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Yonyou Ksoa