Description

A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/search_list.jsp. Executing a manipulation of the argument address can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-22T01:16:56.077Z",
  "pubdate": "2026-09-22T01:16:56.077Z",
  "executiveSummary": "A SQL injection vulnerability exists in Yonyou KSOA 9.0, specifically within the /cardcase/search_list.jsp component.\nThe vulnerability originates from improper neutralization of user-supplied input provided via the 'address' argument, allowing an unauthenticated remote attacker to manipulate database queries.\nSuccessful exploitation enables unauthorized interaction with the backend database, potentially leading to sensitive data exfiltration, modification, or complete compromise of the database management system.\nThe vulnerability is currently public, and the vendor has not provided a patch or formal response, increasing the risk for organizations running this software.\nThe attack vector is remote, requiring no special privileges or prior authentication to initiate the exploit. Immediate action is required to monitor or restrict access to the affected file.",
  "technicalDetails": "The vulnerability is identified as a classic SQL injection flaw located in the /cardcase/search_list.jsp file of the Yonyou KSOA 9.0 application. The root cause is the insecure handling of the 'address' HTTP parameter, which is concatenated directly into a backend SQL query string without adequate sanitization, parameterized queries, or prepared statements.\nAn attacker can exploit this flaw by injecting malicious SQL fragments into the 'address' argument. Because the application fails to validate the structure or content of this input, the database engine executes the injected SQL commands as part of the intended query. This allows the attacker to alter the query logic to bypass authentication, reveal hidden records, or perform unauthorized administrative actions.\nThe attack flow proceeds as follows: 1. The attacker identifies the target endpoint /cardcase/search_list.jsp. 2. The attacker crafts a malicious HTTP GET or POST request where the 'address' parameter is appended with SQL injection payloads (e.g., using UNION-based techniques or boolean-based inference). 3. The application's server-side logic processes the 'address' input by embedding it into the query. 4. The database driver transmits the tainted query to the backend database server. 5. The database parses and executes the attacker's malicious SQL, returning data requested by the attacker or executing destructive commands.\nThis vulnerability is externally accessible via standard HTTP protocols over the network. There are no authentication requirements for an attacker to reach the vulnerable endpoint, making the attack surface broad. Post-exploitation impact is severe, as attackers can leverage the database's permissions to extract sensitive user information, configuration data, or system credentials. Furthermore, depending on the backend database configuration (such as MSSQL or MySQL), an attacker might be able to escalate their impact to file system access, command execution, or service disruption."
}