Yonyou KSOA 9.0 contains a flaw in its HTTP GET parameter handling at /worksheet/del_work.jsp; manipulating the ID parameter allows an attacker to inject arbitrary SQL. This vulnerability is a classic database injection that can lead to unauthorized data access, tampering, or even full database compromise. The weakness is identified as CWE-74 and CWE-89, representing malformed URL handling and SQL injection respectively.

The affected application is Yonyou KSOA version 9.0, specifically the /worksheet/del_work.jsp resource. No other versions or components are listed as affected.

The CVSS score of 6.9 indicates a medium severity risk, and the EPSS score of less than 1% suggests that the likelihood of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog, but it has been publicly disclosed and an exploit is available, making it a potential threat once a suitable target is identified. Remote exploitation can be performed by submitting a crafted ID parameter via standard HTTP GET requests, and because Yonyou did not respond to the vendor communication, no official fix is known at this time. The risk thus depends on whether the system is exposed to untrusted users and whether adequate input validation or network segmentation is in place.