A vulnerability was discovered in Yonyou KSOA 9.0 that allows an attacker to manipulate the ID parameter in the /worksheet/work_mod.jsp HTTP GET request. This manipulation can place arbitrary SQL code into the query executed by the server, enabling untrusted input to influence the database logic. The flaw is classified as a SQL injection weakness, which can lead to unauthorized data disclosure, modification, or deletion, and potentially compromise system integrity and confidentiality.

The affected component is the KSOA 9.0 application from Yonyou, specifically the work_mod.jsp handler in the worksheet module. No additional versions are listed; the known CPE entries point to version 9.0, while the generic string covers all 9.x releases.

The CVSS score of 6.9 indicates moderate severity. The EPSS score shows a probability of exploitation of less than 1%, suggesting it is not widely observed, yet the vulnerability is publicly documented and an exploit is available. The issue can be triggered remotely without authentication, and the vendor has not responded to disclosure. Because it is not present in CISA’s KEV catalog, it is not a known exploited vulnerability at the time of analysis. The primary attack vector is a remote unauthenticated HTTP GET request, and the impact is limited to the scope of the application’s database access.