Description
A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.saleorder.sendaudit of the component OpenAPI. The manipulation of the argument operator leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-22
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection leading to unauthorized database access
Action: Apply Patch
AI Analysis

Impact

A flaw in Yonyou U8cloud 5.x allows an attacker to manipulate the operator argument in the /u8cloud/openapi/so.saleorder.sendaudit endpoint, causing arbitrary SQL statements to be executed against the database. This vulnerability is classified under CWE-74 and CWE-89 and enables attackers to read or modify sensitive data or disrupt normal database operations.

Affected Systems

The affected vendor and product are Yonyou U8cloud 5.x. The SQL injection resides in the OpenAPI component, specifically in the file /u8cloud/openapi/so.saleorder.sendaudit. Any deployment running version 5.x that exposes this API endpoint is at risk.

Risk and Exploitability

The CVSS score of 5.3 reflects a medium severity. EPSS is not available and the flaw is not listed in CISA KEV. A public exploit has been disclosed and the attack can be initiated remotely by sending a crafted operator parameter to the API, potentially giving the attacker unauthorized access to the database.

Generated by OpenCVE AI on September 22, 2026 at 02:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor’s official patch or newer release for U8cloud 5.x when available.
  • Implement input validation or parameter binding to reject malformed SQL operators before database execution.
  • Restrict network access to the OpenAPI endpoint to trusted hosts and consider a WAF rule set to block known SQL injection signatures.
  • Monitor logs for unusual queries or repeated failed authentication attempts targeting the /so.saleorder.sendaudit endpoint.

Generated by OpenCVE AI on September 22, 2026 at 02:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Yonyou u8 Cloud
Vendors & Products Yonyou u8 Cloud

Tue, 22 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.saleorder.sendaudit of the component OpenAPI. The manipulation of the argument operator leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Yonyou U8cloud OpenAPI so.saleorder.sendaudit sql injection
First Time appeared Yonyou
Yonyou u8cloud
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:yonyou:u8cloud:*:*:*:*:*:*:*:*
Vendors & Products Yonyou
Yonyou u8cloud
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Yonyou U8 Cloud U8cloud
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-22T12:45:31.289Z

Reserved: 2026-09-21T17:46:48.595Z

Link: CVE-2026-94492

cve-icon Vulnrichment

Updated: 2026-09-22T12:45:22.641Z

cve-icon NVD

Status : Deferred

Published: 2026-09-22T01:16:56.253

Modified: 2026-09-22T19:04:55.677

Link: CVE-2026-94492

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T19:16:08Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')