An unauthenticated SQL injection flaw exists in the attach_ids parameter of the downloadAtt.jsp endpoint in the Seeyon A6 collaborative office automation platform. The vulnerability permits attackers to inject UNION-based SQL statements, enabling the extraction of sensitive data such as credentials and system configuration from the database without possessing any valid user credentials. By manipulating this parameter, a remote attacker can retrieve arbitrary database contents, compromising confidentiality and potentially exposing critical operational information.

The vulnerability affects the Yonyou A6 OA office automation software. No specific versions are listed in the CNA data, so all deployments of this product should be considered potentially vulnerable until a vendor patch is released.

With a CVSS score of 8.7, the flaw is rated as high severity. The exploitability is significant because authentication is not required; an attacker only needs to send a crafted request to the downloadAtt.jsp endpoint from an accessible network. While EPSS data is not available and the vulnerability is not listed in CISA KEV, the potential for data exfiltration and the lack of authentication barriers mean that exploitation could occur from any unpatched system exposed to the web. The attack path is simple: directly target the vulnerable parameter with UNION-based SQL statements and retrieve database information.