The vulnerability resides in the /worksheet/work_report.jsp HTTP GET Parameter Handler of Yonyou KSOA 9.0. Manipulating the ID argument injects malicious SQL directly into a backend query, allowing an attacker to read, alter, or delete data stored in the database. Because the flaw is exposed through a normal HTTP GET request, the attacker can potentially compromise the confidentiality, integrity, or availability of the application’s data without requiring prior authentication.

Yonyou KSOA version 9.0 is the affected product. The vulnerability is present in the KSOA 9.0 release and is referenced by the corresponding CPE string.

The CVSS score of 6.9 indicates a moderate risk, and the EPSS score of less than 1% shows that while exploitation is theoretically possible, it is not currently common. The exploit code is publicly available and can be executed over the network by sending a crafted GET request to work_report.jsp. The lack of a publicly available patch and absence from the CISA KEV list mean that system administrators should treat this as a high priority to mitigate potential damage.