CVE-2026-1123
Unknown Unknown - Not Provided
SQL Injection in Yonyou KSOA 9.0 HTTP GET Parameter Handler

Publication date: 2026-01-18

Last updated on: 2026-04-29

Assigner: VulDB

Description
A vulnerability was identified in Yonyou KSOA 9.0. Affected is an unknown function of the file /worksheet/work_mod.jsp of the component HTTP GET Parameter Handler. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-18
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2026-01-19
EPSS Evaluated
2026-06-15
NVD
CVE-2026-1123
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
yonyou ksoa 9.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Detection Guidance

This vulnerability can be detected by testing the vulnerable URL parameter 'id' in /worksheet/work_mod.jsp for SQL injection. A practical method is to use the sqlmap tool with a command like: python sqlmap.py -u "http://<target>/worksheet/work_mod.jsp?id=1*" --dbms=mssql --batch --dbs. Additionally, Google dorking with the query inurl:worksheet/work_mod.jsp can help identify vulnerable targets. [1, 3]

Compliance Impact

The provided resources do not explicitly discuss the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA. However, since the vulnerability allows unauthorized database access, data leakage, and data tampering, it could potentially lead to violations of data protection and privacy regulations that require safeguarding sensitive information. No direct statements about compliance impact are available. [1, 2, 3]

Executive Summary

CVE-2026-1123 is a SQL injection vulnerability in Yonyou KSOA version 9.0, specifically in the HTTP GET parameter 'id' of the file /worksheet/work_mod.jsp. The application directly concatenates this parameter into SQL queries without proper validation or parameterization, allowing remote attackers to inject malicious SQL commands without authentication. This can lead to unauthorized database access, data leakage, and manipulation. [1, 2, 3]

Impact Analysis

Exploitation of this vulnerability can allow an unauthenticated remote attacker to access, leak, or manipulate sensitive data stored in the backend Microsoft SQL Server database. It can compromise the confidentiality, integrity, and availability of the affected system, potentially leading to unauthorized administrative control over the database server and disruption of services. [1, 2, 3]

Mitigation Strategies

Immediate mitigation steps include implementing parameterized queries (prepared statements) to prevent SQL injection, applying strict input validation on the 'id' parameter (e.g., allowing only integers), deploying a Web Application Firewall (WAF) to detect and block SQL injection attempts, and disabling detailed database error messages on the frontend to avoid information leakage. Considering replacing the affected product is also suggested since no official vendor patch is available. [1, 3]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-1123. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart