A flaw exists in Yonyou KSOA 9.0 that allows an attacker to inject arbitrary SQL through the ID parameter of the /worksheet/worksadd_plan.jsp page. By manipulating this HTTP GET argument, the attacker can read, modify, or delete records stored in the application database, thereby damaging data confidentiality and integrity.

The vulnerability affects Yonyou KSOA version 9.0. No other versions are listed as impacted.

The CVSS score of 6.9 indicates medium severity. Exploit efforts are low according to an EPSS score of less than 1%, yet published proof‑of‑concept code is available, and the attack can be performed remotely via an HTTP GET request. The vulnerability is not listed in CISA’s KEV catalog at this time. Attackers who can reach the vulnerable endpoint may reach the database layer and potentially compromise sensitive organizational data.