CVE-2025-15421
SQL Injection in Yonyou KSOA 9.0 HTTP GET Parameter Handler
Publication date: 2026-01-02
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yonyou | ksoa | 9.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2025-15421 is a SQL injection vulnerability in Yonyou KSOA version 9.0, specifically in the HTTP GET parameter 'id' of the file /worksheet/agent_worksadd.jsp. The vulnerability occurs because the 'id' parameter is not properly validated or neutralized before being used in a backend SQL query, allowing an attacker to inject malicious SQL commands. This flaw can be exploited remotely without authentication, enabling attackers to manipulate the database or server. [1, 3, 4]
How can this vulnerability impact me? :
This vulnerability can compromise the confidentiality, integrity, and availability of the affected system. An attacker can remotely inject SQL commands to gain unauthorized access to the database, leak sensitive data, or manipulate the server. Because it requires no authentication and has a public exploit, it poses a high risk of exploitation leading to data breaches or service disruption. [1, 3, 4]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of the vulnerable endpoint /worksheet/agent_worksadd.jsp and testing the HTTP GET parameter 'id' for SQL injection. One method is to use Google dorking with the query: inurl:worksheet/agent_worksadd.jsp to identify potentially vulnerable targets. For active testing, you can use tools like curl or sqlmap to send crafted requests to the URL with the 'id' parameter to check for SQL injection. Example curl command: curl -v "http://target/worksheet/agent_worksadd.jsp?id=1' OR '1'='1". Alternatively, sqlmap can be used as: sqlmap -u "http://target/worksheet/agent_worksadd.jsp?id=1" --batch --dbs to test and enumerate databases if vulnerable. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the affected component with an alternative product, as no vendor patches or mitigations are available. Additionally, restricting access to the vulnerable endpoint via network controls such as firewalls or web application firewalls (WAF) can help reduce exposure. Monitoring and blocking suspicious requests targeting the 'id' parameter can also mitigate exploitation risk. Ultimately, avoid using the vulnerable version of Yonyou KSOA 9.0 or apply custom input validation and parameterized queries if possible. [1]