Description
A security vulnerability has been detected in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /kmf/select.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument folderid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-01-19
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Patch Urgently
AI Analysis

Impact

A flaw in the folderid parameter of the /kmf/select.jsp page allows an attacker to inject arbitrary SQL text into ordinary HTTP GET requests. The injection can be used to read, alter, or delete data in the underlying database, leading to confidentiality or integrity compromise of business information. The weakness is reflected in CWE-74 and CWE-89, both describing improper neutralization of special elements in an SQL statement.

Affected Systems

Yonyou KSOA version 9.0 is affected. The vulnerability resides in the HTTP GET handler for /kmf/select.jsp, which is exposed by the KSOA web application. No other product versions are listed as impacted, and no patch information is currently available.

Risk and Exploitability

The CVSS score is 6.9, indicating a moderate to high severity. EPSS is below 1%, suggesting a low current probability of exploitation, and the vulnerability does not appear in the KEV catalog. The attack vector is remote, as it requires only a crafted URL sent over HTTP; no authentication or additional access privilege is necessary for exploitation.

Generated by OpenCVE AI on April 18, 2026 at 04:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s security update or upgrade to a patched Yonyou KSOA release as soon as it becomes available.
  • If a patch is not available, restrict or block access to /kmf/select.jsp, and implement input validation or parameterized queries for the folderid parameter to prevent SQL injection.
  • Deploy a web application firewall or similar filtering to detect and block typical SQL injection patterns targeting the folderid argument, and log all suspicious requests for further analysis.
  • Ensure the database account used by the KSOA application has the minimum privileges required, limiting the potential damage should an injection succeed.

Generated by OpenCVE AI on April 18, 2026 at 04:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Feb 2026 09:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:yonyou:ksoa:*:*:*:*:*:*:*:*

Thu, 05 Feb 2026 20:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:yonyou:ksoa:9.0:*:*:*:*:*:*:*

Wed, 21 Jan 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Jan 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Yonyou
Yonyou ksoa
Vendors & Products Yonyou
Yonyou ksoa

Mon, 19 Jan 2026 22:15:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /kmf/select.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument folderid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Yonyou KSOA HTTP GET Parameter select.jsp sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Yonyou Ksoa
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T08:49:45.814Z

Reserved: 2026-01-19T07:33:56.986Z

Link: CVE-2026-1178

cve-icon Vulnrichment

Updated: 2026-01-21T20:36:45.692Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-19T22:16:02.273

Modified: 2026-02-05T19:53:50.610

Link: CVE-2026-1178

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T05:00:06Z

Weaknesses