The vulnerability resides in an unspecified portion of the Yonyou KSOA search_list.jsp file, where manipulating the address parameter allows an attacker to inject SQL statements. The attack can be performed remotely via standard HTTP requests, and publicly released exploit code indicates that unauthorized data retrieval or manipulation is feasible. The description does not confirm remote code execution, but the injection could still expose sensitive information or enable further attacks if privileged database access is achieved.

Yonyou KSOA version 9.0 is impacted. The weakness lies in the search_list.jsp component of this product; no other versions or products are listed as affected.

The CVSS score of 6.9 classifies the flaw as medium severity, and the EPSS score is currently unavailable, indicating an unknown but possible exploitation probability. It has not yet been listed in the CISA KEV catalog, though publicly available exploits suggest attackers could target the vulnerability. The likely attack vector is remote, via crafted HTTP requests that include malicious payloads in the address parameter.