A potential SQL injection flaw exists in the Yonyou KSOA 9.0 component that handles HTTP GET parameters for the /kmf/user_popedom.jsp page. Manipulating the folderid argument allows attackers to inject arbitrary SQL code. This can enable unauthorized data disclosure, manipulation of database records, and potential escalation of privileges if the injected payload attacks application logic or database triggers. The weakness is classified as CWE-74 and CWE-89, reflecting improper handling of user‑supplied input and unescaped SQL.

Vendor: Yonyou. Product: KSOA version 9.0, relevant to clients running that specific release of the KSOA enterprise resource planning suite. The affected code resides at /kmf/user_popedom.jsp and is accessible through HTTP GET requests.

The CVSS score of 6.9 indicates a moderate severity for this threat, while the EPSS score of less than 1 % suggests that exploitation is currently unlikely at a large scale. However, because the vulnerability is publicly documented and can be triggered remotely via a standard HTTP request to the affected endpoint, its practical risk remains noteworthy for organizations running the vulnerable KSOA version. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but its remote exploitation potential warrants immediate attention. The likely attack vector is through a maliciously crafted GET request targeting the folderid query parameter, leading to direct injection into the database engine.