This vulnerability permits injection of arbitrary SQL through the catalogid parameter in the /kmc/save_catalog.jsp file. An attacker can execute any SQL statement on the backend database, potentially reading, modifying, or deleting data, which compromises confidentiality, integrity, and availability.

Yonyou KSOA version 9.0 is affected. The issue resides in the component accessed via /kmc/save_catalog.jsp. The CPE indicates that the vulnerability is specific to KSOA 9.0 and earlier snapshots without a known fix.

CVSS score 6.9 reflects a moderate‑severity flaw, while an EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild. The vulnerability is exposed through a remote HTTP GET request, so a threat actor can trigger it without local privileges. The absence of a vendor patch and the unreceptive vendor response increase operational risk; however, the current exploit probability remains low. The flaw is not listed in the CISA KEV catalog, indicating no confirmed exploit activity to date.