CVE-2026-1129: Yonyou KSOA 9.0 SQL Injection Vulnerability

CVE-2026-1129 Overview

A SQL injection vulnerability has been identified in Yonyou KSOA 9.0, specifically affecting the /worksheet/worksadd.jsp file within the HTTP GET Parameter Handler component. This vulnerability allows remote attackers to manipulate the ID parameter to inject arbitrary SQL commands, potentially compromising the underlying database and sensitive data.

The vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), commonly referred to as injection. The exploit has been publicly disclosed, and the vendor was contacted regarding this disclosure but did not respond.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to extract, modify, or delete database contents, potentially leading to data breaches and unauthorized access to sensitive information.

Affected Products

• Yonyou KSOA 9.0
• HTTP GET Parameter Handler component in /worksheet/worksadd.jsp

Discovery Timeline

• 2026-01-19 - CVE CVE-2026-1129 published to NVD
• 2026-01-19 - Last updated in NVD database

Technical Details for CVE-2026-1129

Vulnerability Analysis

This SQL injection vulnerability exists in the worksadd.jsp endpoint of Yonyou KSOA 9.0. The vulnerable parameter ID accepts user-supplied input through HTTP GET requests without proper sanitization or parameterized query implementation. When malicious SQL syntax is injected into this parameter, it is concatenated directly into backend database queries, allowing attackers to manipulate the query logic.

The network-accessible nature of this vulnerability means that any attacker with HTTP access to the affected endpoint can attempt exploitation without requiring authentication or user interaction. Successful exploitation could result in unauthorized read access to database contents (confidentiality impact), modification of data (integrity impact), and potential disruption of database operations (availability impact).

Root Cause

The root cause of this vulnerability is improper input validation and the lack of parameterized queries or prepared statements in the worksadd.jsp file. User-supplied data from the ID parameter is directly concatenated into SQL queries without sanitization, escaping, or type checking. This allows specially crafted input to break out of the intended query context and execute arbitrary SQL commands.

Attack Vector

The attack is performed remotely over the network via HTTP GET requests to the vulnerable endpoint /worksheet/worksadd.jsp. An attacker crafts a malicious value for the ID parameter containing SQL injection payloads. When processed by the application, these payloads modify the intended SQL query behavior.

The vulnerability can be exploited by appending SQL syntax to the ID parameter value, such as union-based, error-based, or time-based blind injection techniques. The attacker sends a crafted HTTP GET request to the vulnerable JSP endpoint with the manipulated ID parameter. The server processes the request and executes the injected SQL commands against the backend database, returning results or exhibiting behavior that confirms successful injection.

For technical details and proof-of-concept information, refer to the GitHub Issue Discussion and VulDB entry #341719.

Detection Methods for CVE-2026-1129

Indicators of Compromise

• HTTP GET requests to /worksheet/worksadd.jsp containing SQL syntax characters such as single quotes, double dashes, semicolons, or SQL keywords like UNION, SELECT, INSERT, DELETE
• Unusual database query patterns or errors in application logs related to the worksadd.jsp endpoint
• Unexpected database access patterns or data exfiltration attempts originating from web application processes
• Web server access logs showing repeated requests to the vulnerable endpoint with varying payloads

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in requests to /worksheet/worksadd.jsp
• Configure intrusion detection systems (IDS) to alert on HTTP requests containing common SQL injection signatures targeting the ID parameter
• Enable verbose SQL query logging on the database server and monitor for malformed or suspicious queries originating from the KSOA application
• Deploy SentinelOne Singularity to detect anomalous process behavior and potential post-exploitation activities

Monitoring Recommendations

• Monitor HTTP access logs for requests to /worksheet/worksadd.jsp with encoded or obfuscated SQL injection patterns
• Set up alerts for database errors or exceptions that may indicate SQL injection attempts
• Track and alert on unusual outbound data transfers from the database server that could indicate data exfiltration
• Implement real-time monitoring of database query execution times to detect time-based blind SQL injection attempts

How to Mitigate CVE-2026-1129

Immediate Actions Required

• Restrict network access to the /worksheet/worksadd.jsp endpoint using firewall rules or access control lists until a patch is available
• Deploy a Web Application Firewall with SQL injection protection rules to filter malicious requests
• If possible, disable or remove the vulnerable worksadd.jsp functionality if it is not critical to operations
• Implement input validation at the web server or reverse proxy level to reject requests with suspicious characters in the ID parameter

Patch Information

As of the last update on 2026-01-19, no official patch has been released by Yonyou. The vendor was contacted about this disclosure but did not respond. Organizations should monitor the vendor's security advisories and VulDB for updates on patch availability.

Workarounds

• Implement strict input validation to allow only numeric values in the ID parameter if the expected input is a numeric identifier
• Use a reverse proxy or WAF to sanitize and filter requests before they reach the vulnerable application
• Consider implementing database user account restrictions to limit the permissions of the account used by the KSOA application
• If source code access is available, modify the worksadd.jsp to use parameterized queries or prepared statements for all database operations

# Example: Apache mod_security rule to block SQL injection attempts
# Add to Apache configuration or .htaccess

SecRule ARGS:ID "@detectSQLi" \
    "id:100001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'SQL Injection attempt blocked on worksadd.jsp',\
    tag:'attack-sqli'"