CVE-2026-1122: Yonyou KSOA 9.0 SQL Injection Vulnerability

CVE-2026-1122 Overview

A SQL injection vulnerability has been identified in Yonyou KSOA 9.0, affecting the HTTP GET Parameter Handler component. The vulnerability exists in the /worksheet/work_info.jsp file, where improper handling of the ID parameter allows attackers to inject malicious SQL commands. This flaw can be exploited remotely without authentication, potentially allowing unauthorized access to sensitive database information, data manipulation, or further system compromise.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to access, modify, or delete database contents without authentication, potentially compromising the confidentiality and integrity of business-critical data managed by Yonyou KSOA.

Affected Products

• Yonyou KSOA 9.0
• Yonyou KSOA HTTP GET Parameter Handler component
• /worksheet/work_info.jsp endpoint

Discovery Timeline

• 2026-01-18 - CVE-2026-1122 published to NVD
• 2026-01-18 - Last updated in NVD database

Technical Details for CVE-2026-1122

Vulnerability Analysis

This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), commonly manifesting as SQL injection. The flaw resides in how the application processes user-supplied input through the ID parameter in HTTP GET requests to the /worksheet/work_info.jsp endpoint.

When the application receives a request, it fails to properly sanitize or parameterize the ID value before incorporating it into SQL queries. This allows an attacker to craft malicious input that escapes the intended query context and executes arbitrary SQL commands against the underlying database.

The vulnerability has been publicly disclosed, and the vendor was contacted about this issue but did not respond. This lack of vendor response increases the risk for organizations using affected versions, as no official patch or mitigation guidance has been provided.

Root Cause

The root cause of this vulnerability is improper input validation and lack of parameterized queries in the /worksheet/work_info.jsp file. The application directly concatenates user-supplied input from the ID GET parameter into SQL statements without proper sanitization or the use of prepared statements. This allows special SQL characters and commands to be interpreted as part of the query structure rather than as literal data values.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by sending a crafted HTTP GET request to the vulnerable endpoint with a malicious payload in the ID parameter.

The exploitation process involves:

1. Identifying the vulnerable endpoint at /worksheet/work_info.jsp
2. Crafting a malicious ID parameter containing SQL injection payloads
3. Sending the request remotely over the network
4. The backend database executing the injected SQL commands

Due to the sensitive nature of this vulnerability and the lack of verified code examples, specific exploitation details are not provided here. Technical details can be found in the GitHub CVE Issue Discussion and VulDB #341714.

Detection Methods for CVE-2026-1122

Indicators of Compromise

• Unusual HTTP GET requests to /worksheet/work_info.jsp containing SQL syntax characters such as single quotes, double dashes, or UNION statements in the ID parameter
• Database logs showing unexpected query patterns or error messages related to SQL syntax errors
• Web application logs with anomalous parameter values containing encoded or obfuscated SQL commands
• Evidence of data exfiltration or unauthorized database access originating from web server connections

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in the ID parameter of requests to /worksheet/work_info.jsp
• Deploy intrusion detection systems (IDS) with signatures for SQL injection attempts targeting Yonyou KSOA endpoints
• Enable and monitor database audit logging to identify unusual query patterns or unauthorized data access
• Configure application-level logging to capture and alert on requests with suspicious parameter values

Monitoring Recommendations

• Monitor HTTP access logs for requests to /worksheet/work_info.jsp with abnormal ID parameter lengths or special characters
• Set up alerts for database query failures or syntax errors that may indicate exploitation attempts
• Implement real-time log correlation to identify patterns of SQL injection reconnaissance or exploitation
• Review database connection logs for unexpected access patterns from web application service accounts

How to Mitigate CVE-2026-1122

Immediate Actions Required

• Restrict network access to the /worksheet/work_info.jsp endpoint using firewall rules or access control lists
• Deploy a Web Application Firewall (WAF) with SQL injection detection rules in front of affected Yonyou KSOA instances
• Implement input validation at the network perimeter to filter requests containing SQL injection patterns
• Consider disabling or removing access to the affected endpoint if it is not business-critical

Patch Information

No official patch is currently available from the vendor. According to the vulnerability disclosure, the vendor was contacted about this issue but did not respond. Organizations should monitor vendor communications and security advisories for future patch releases. Additional vulnerability details are available at VulDB Connection Tracking Insight and the VulDB Submission Entry.

Workarounds

• Implement strict input validation on the ID parameter to allow only expected numeric or alphanumeric values
• Deploy network-level access controls to limit which IP addresses can reach the vulnerable endpoint
• Use a reverse proxy to filter and sanitize incoming requests before they reach the application
• Consider virtual patching through WAF rules specifically targeting this vulnerability until an official patch is available

# Example WAF rule configuration (ModSecurity)
# Block SQL injection attempts in ID parameter for work_info.jsp
SecRule REQUEST_URI "@contains /worksheet/work_info.jsp" \
    "id:2026001122,\
    phase:2,\
    deny,\
    status:403,\
    chain"
    SecRule ARGS:ID "@detectSQLi" \
        "msg:'CVE-2026-1122 SQL Injection Attempt Blocked'"