The vulnerability is caused by insufficient validation of the ID argument in the del_workplan.jsp handler, which allows an attacker to inject arbitrary SQL statements. This is identified as a SQL injection flaw, as indicated by CWE-89. Based on the nature of SQL injection, an attacker could potentially retrieve, modify or delete data in the database, compromising confidentiality and integrity. The potential impact includes data disclosure, modification, or corruption of the underlying database, which would further compromise the application’s data security.

The affected product is Yonyou KSOA version 9.0, as specified by the vendor name and the CPE entries. No other versions are listed as vulnerable in the provided information.

The CVSS score of 6.9 rates the issue as medium severity, while the EPSS score of less than 1% indicates a low probability of exploitation at this time. The vulnerability is publicly disclosed and can be launched remotely, but it is not listed in the CISA Known Exploited Vulnerabilities catalog. Though exploitation is unlikely, the remote nature of the attack vector presents a significant risk to organizations that have not patched or mitigated the flaw.