A SQL injection flaw exists in the HTTP GET parameter handler of the /worksheet/work_info.jsp file in Yonyou KSOA. When the ID argument is manipulated, an attacker can inject arbitrary SQL statements, allowing unauthorized read or modification of the database. The vulnerability is exploitable remotely via a crafted HTTP GET request and has been publicly disclosed, meaning the attack vector is widely available.

Yonyou KSOA version 9.0 is affected. Systems running this version without a vendor patch are vulnerable; the issue is specific to the web component that processes GET parameters for the work_info.jsp page.

The CVSS score of 6.9 reflects a moderate severity with the potential for significant impact if exploited. The EPSS score of less than 1% indicates that, at the time of analysis, the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the flaw can be leveraged remotely through ordinary HTTP traffic, making it a valid concern for environments exposed to the internet or untrusted networks.