CVE-2026-1122: Yonyou KSOA 9.0 SQL Injection Vulnerability

CVE-2026-1122 Overview

A SQL injection vulnerability has been identified in Yonyou KSOA 9.0, affecting the HTTP GET Parameter Handler component. The vulnerability exists in the /worksheet/work_info.jsp file, where improper handling of the ID parameter allows attackers to inject malicious SQL commands. This flaw can be exploited remotely without authentication, potentially allowing unauthorized access to sensitive database information, data manipulation, or further system compromise.

Critical Impact
Remote attackers can exploit this SQL injection vulnerability to access, modify, or delete database contents without authentication, potentially compromising the confidentiality and integrity of business-critical data managed by Yonyou KSOA.

Affected Products

Yonyou KSOA 9.0
Yonyou KSOA HTTP GET Parameter Handler component
/worksheet/work_info.jsp endpoint

Discovery Timeline

2026-01-18 - CVE-2026-1122 published to NVD
2026-01-18 - Last updated in NVD database

Technical Details for CVE-2026-1122

Vulnerability Analysis

This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), commonly manifesting as SQL injection. The flaw resides in how the application processes user-supplied input through the ID parameter in HTTP GET requests to the /worksheet/work_info.jsp endpoint.

When the application receives a request, it fails to properly sanitize or parameterize the ID value before incorporating it into SQL queries. This allows an attacker to craft malicious input that escapes the intended query context and executes arbitrary SQL commands against the underlying database.

The vulnerability has been publicly disclosed, and the vendor was contacted about this issue but did not respond. This lack of vendor response increases the risk for organizations using affected versions, as no official patch or mitigation guidance has been provided.

Root Cause

The root cause of this vulnerability is improper input validation and lack of parameterized queries in the /worksheet/work_info.jsp file. The application directly concatenates user-supplied input from the ID GET parameter into SQL statements without proper sanitization or the use of prepared statements. This allows special SQL characters and commands to be interpreted as part of the query structure rather than as literal data values.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by sending a crafted HTTP GET request to the vulnerable endpoint with a malicious payload in the ID parameter.

The exploitation process involves:

Identifying the vulnerable endpoint at /worksheet/work_info.jsp
Crafting a malicious ID parameter containing SQL injection payloads
Sending the request remotely over the network
The backend database executing the injected SQL commands

Due to the sensitive nature of this vulnerability and the lack of verified code examples, specific exploitation details are not provided here. Technical details can be found in the GitHub CVE Issue Discussion and VulDB #341714.

Detection Methods for CVE-2026-1122

Indicators of Compromise

Unusual HTTP GET requests to /worksheet/work_info.jsp containing SQL syntax characters such as single quotes, double dashes, or UNION statements in the ID parameter
Database logs showing unexpected query patterns or error messages related to SQL syntax errors
Web application logs with anomalous parameter values containing encoded or obfuscated SQL commands
Evidence of data exfiltration or unauthorized database access originating from web server connections

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in the ID parameter of requests to /worksheet/work_info.jsp
Deploy intrusion detection systems (IDS) with signatures for SQL injection attempts targeting Yonyou KSOA endpoints
Enable and monitor database audit logging to identify unusual query patterns or unauthorized data access
Configure application-level logging to capture and alert on requests with suspicious parameter values

Monitoring Recommendations

Monitor HTTP access logs for requests to /worksheet/work_info.jsp with abnormal ID parameter lengths or special characters
Set up alerts for database query failures or syntax errors that may indicate exploitation attempts
Implement real-time log correlation to identify patterns of SQL injection reconnaissance or exploitation
Review database connection logs for unexpected access patterns from web application service accounts

How to Mitigate CVE-2026-1122

Immediate Actions Required

Restrict network access to the /worksheet/work_info.jsp endpoint using firewall rules or access control lists
Deploy a Web Application Firewall (WAF) with SQL injection detection rules in front of affected Yonyou KSOA instances
Implement input validation at the network perimeter to filter requests containing SQL injection patterns
Consider disabling or removing access to the affected endpoint if it is not business-critical

Patch Information

No official patch is currently available from the vendor. According to the vulnerability disclosure, the vendor was contacted about this issue but did not respond. Organizations should monitor vendor communications and security advisories for future patch releases. Additional vulnerability details are available at VulDB Connection Tracking Insight and the VulDB Submission Entry.

Workarounds

Implement strict input validation on the ID parameter to allow only expected numeric or alphanumeric values
Deploy network-level access controls to limit which IP addresses can reach the vulnerable endpoint
Use a reverse proxy to filter and sanitize incoming requests before they reach the application
Consider virtual patching through WAF rules specifically targeting this vulnerability until an official patch is available

bash

# Example WAF rule configuration (ModSecurity)
# Block SQL injection attempts in ID parameter for work_info.jsp
SecRule REQUEST_URI "@contains /worksheet/work_info.jsp" \
    "id:2026001122,\
    phase:2,\
    deny,\
    status:403,\
    chain"
    SecRule ARGS:ID "@detectSQLi" \
        "msg:'CVE-2026-1122 SQL Injection Attempt Blocked'"