CVE-2026-94491: Yonyou KSOA 9.0 SQL Injection Vulnerability

CVE-2026-94491 Overview

CVE-2026-94491 is a SQL injection vulnerability in Yonyou KSOA 9.0. The flaw resides in the /cardcase/search_list.jsp component, where the address parameter is not properly sanitized before use in a database query. Remote attackers can manipulate this parameter to inject arbitrary SQL statements. According to the disclosure, a public exploit is available and could be used in attacks. The vendor was contacted prior to disclosure but did not respond. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can inject SQL statements through the address parameter of search_list.jsp, exposing backend database contents to read, modification, or destruction.

Affected Products

Yonyou KSOA 9.0
Component: /cardcase/search_list.jsp
Parameter: address

Discovery Timeline

2026-09-22 - CVE-2026-94491 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94491

Vulnerability Analysis

The vulnerability affects the search_list.jsp file within the cardcase module of Yonyou KSOA 9.0. The address HTTP request parameter is concatenated into a SQL query without adequate input validation or parameterization. Attackers who send crafted HTTP requests can alter the intended query logic and execute arbitrary SQL statements against the backend database.

Exploitation requires no authentication and no user interaction. The attack can be launched remotely over the network, making this vulnerability accessible to any actor who can reach the affected web application. Public exploit details have been referenced in third-party vulnerability databases, increasing the likelihood of opportunistic attacks against exposed KSOA installations.

Root Cause

The root cause is improper neutralization of user-supplied input in a SQL statement, categorized under [CWE-74]. The address parameter is passed directly into a query built via string concatenation rather than through prepared statements or bound parameters. This allows meta-characters such as single quotes, semicolons, and SQL keywords to alter query semantics.

Attack Vector

An attacker crafts an HTTP request to /cardcase/search_list.jsp with a malicious payload in the address parameter. Injected SQL clauses can extract table contents, enumerate database schemas, modify records, or trigger stacked queries depending on database engine permissions. Because the exploit has been made public, attackers can reproduce the technique without prior research.

A sanitized description of the request pattern: an HTTP GET or POST to the vulnerable JSP endpoint carrying an address value that includes SQL operators or UNION clauses. Refer to the VulDB entry for CVE-2026-94491 for further technical detail.

Detection Methods for CVE-2026-94491

Indicators of Compromise

HTTP requests to /cardcase/search_list.jsp containing SQL meta-characters such as ', --, UNION, SELECT, or SLEEP( in the address parameter.
Web server or application logs showing abnormal response sizes or database errors tied to the search_list.jsp endpoint.
Outbound database connections initiating unexpected schema enumeration queries during request handling.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect the address query parameter for SQL injection patterns.
Enable database audit logging to flag queries originating from the KSOA application that reference information_schema, sysobjects, or perform time-based delays.
Correlate JSP access logs with database error logs to identify probing behavior against the cardcase module.

Monitoring Recommendations

Continuously monitor request rates and payload entropy for /cardcase/search_list.jsp.
Alert on repeated 500-series responses from the endpoint, which may indicate injection attempts failing due to syntax errors.
Track authentication-less requests hitting the endpoint from unfamiliar IP ranges or automated scanners.

How to Mitigate CVE-2026-94491

Immediate Actions Required

Restrict network exposure of the KSOA 9.0 application by placing it behind a VPN or IP allowlist.
Deploy WAF rules to block SQL injection payloads targeting the address parameter on /cardcase/search_list.jsp.
Review database account permissions used by the application and enforce least privilege to limit exploitation impact.

Patch Information

At the time of publication, no vendor patch has been released. According to the disclosure, Yonyou was contacted about this vulnerability but did not respond. Monitor the VulDB advisory and Yonyou's official channels for future security updates.

Workarounds

Filter or reject requests to /cardcase/search_list.jsp when the address parameter contains SQL meta-characters or exceeds expected length.
Disable the cardcase module in KSOA 9.0 if it is not required for business operations.
Apply reverse-proxy input validation to normalize and sanitize query parameters before they reach the application server.

bash

# Example WAF rule (ModSecurity) to block SQLi payloads on the vulnerable endpoint
SecRule REQUEST_URI "@contains /cardcase/search_list.jsp" \
    "chain,phase:2,deny,status:403,id:1029491,\
    msg:'CVE-2026-94491 - Yonyou KSOA SQLi attempt on address parameter'"
    SecRule ARGS:address "@detectSQLi" "t:none,t:urlDecode"