The vulnerability allows an attacker to manipulate the folderid parameter in a GET request to the save_folder.jsp endpoint, leading to unfiltered input being incorporated into an SQL query. The result is a classic SQL injection that can expose, modify, or delete data from the underlying database. The weakness originates from the component HTTP GET Parameter Handler. The attacker needs only craft a malicious URL, confirming that the vulnerability can be exploited remotely.

Yonyou KSOA version 9.0 is affected. The vendor Yonyou’s KSOA product contains the vulnerable file save_folder.jsp in the HTTP GET Parameter Handler. No other affected versions are listed.

The CVSS base score of 6.9 indicates a medium‑to‑high severity vulnerability. EPSS is <1%, indicating a low probability of exploitation, but a public exploit has been made available and the vendor has not responded. The likely attack vector is a remote crafted HTTP GET request. Although not listed in CISA KEV, the existence of a public exploit means this vulnerability should be treated as high risk and addressed urgently.