The vulnerability resides in Yonyou KSOA 9.0 within the file /kmf/edit_folder.jsp, where manipulating the HTTP GET parameter folderid allows an attacker to inject arbitrary SQL statements. This flaw is a classic example of an input validation failure, corresponding to CWE‑74 and CWE‑89, and could enable unauthorized data exfiltration or modification if executed successfully.

The affected product is Yonyou KSOA version 9.0. No other versions or additional products were listed as vulnerable. The absence of more granular version information suggests that the flaw is specific to that release of the application.

The CVSS score of 6.9 indicates a moderate to high severity, while the EPSS score of less than 1% signals a low likelihood of widespread exploitation at present. The vulnerability was publicly disclosed and is accessible remotely, but the vendor has not released a patch or workaround. Because the flaw can be triggered over the network, it poses a significant risk if exploited, yet current evidence suggests that active exploitation is unlikely in the near term.