Product Details (At a Glance)

• Product Name: Yonyou KSOA
• Affected Version: 9.0
• Product Type: Enterprise Office Automation / Workflow Platform
• Attack Vector: Remote (HTTP GET requests)
• Authentication Required: No
• Impact Area: Backend Database
• Risk Level: High (Data compromise possible)

Yonyou KSOA 9.0 contains multiple SQL Injection vulnerabilities in different JSP components. These flaws arise due to improper handling of user-supplied input passed directly into SQL queries. Because the affected endpoints are accessible without authentication, a remote attacker can exploit them over the network.

If successfully exploited, an attacker may read sensitive data, manipulate database records, create administrative accounts, or in worst cases, completely compromise the database.

CVE Summary Table

Technical Details – How the Vulnerability Works

The affected JSP pages accept parameters such as folderid from HTTP GET requests. These parameters are inserted directly into SQL statements without proper validation or parameterization.

This allows attackers to inject arbitrary SQL logic that alters how the backend database processes queries.

Example Vulnerable Pattern

SELECT * FROM table WHERE folderid = '<user_input>'

Because the input is not sanitized, an attacker can manipulate the query logic entirely.

Proof of Concept & Exploitation (Educational Only)

Example Payloads Observed in the Wild

/kmf/user_popedom.jsp?folderid=1' OR '1'='1
/kmf/select.jsp?folderid=0 UNION SELECT username,password FROM users
/kmf/save_folder.jsp?folderid=1';-- 

What an Attacker Can Achieve

• Dump database tables (users, credentials, workflow data)
• Modify or delete business records
• Bypass application logic
• Escalate privileges if database permissions are weak

⚠️ These payloads are shown only to help defenders recognize malicious patterns.

MITRE ATT&CK & CWE Mapping

CWE Classification

• CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)

MITRE ATT&CK Techniques

• T1190 – Exploit Public-Facing Application
• T1059 – Command Execution (via database functions)
• T1005 – Data from Local System (database extraction)

Detection & Monitoring Guidance

Log Sources to Monitor

Indicators of Exploitation

Look for:

• Repeated requests with ', --, ;, UNION, OR 1=1
• Abnormal database errors
• Sudden spikes in GET requests to vulnerable JSP files
• Unexpected database read/write activity

Snort Detection Rules

Generic SQL Injection Detection Rule

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (
    msg:"Possible SQL Injection Attempt - Yonyou KSOA";
    flow:to_server,established;
    content:"folderid="; http_uri;
    pcre:"/(\%27)|(\')|(\-\-)|(\%23)|(#)|(\bUNION\b)|(\bOR\b)/Ui";
    classtype:web-application-attack;
    sid:20261179;
    rev:1;
)

Targeted Rule for JSP Endpoints

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (
    msg:"Yonyou KSOA SQL Injection Attempt Detected";
    flow:to_server,established;
    content:"/kmf/"; http_uri;
    content:".jsp?"; http_uri;
    pcre:"/folderid=.*(union|select|or|and|--|;)/Ui";
    classtype:web-application-attack;
    sid:20261180;
    rev:1;
)

Mitigation & Hardening Recommendations

Until a vendor patch is applied, the following controls are strongly recommended:

1. Deploy or update WAF rules to block SQL injection patterns
2. Restrict access to KSOA interfaces via VPN or internal networks
3. Enable strict input validation at reverse proxy or application gateway
4. Use least-privilege database accounts
5. Monitor database logs continuously
6. Apply virtual patching via IDS/WAF

Official Patch / Upgrade Information

As of now:

• No public hotfix is available for individual CVEs
• Recommended action: Upgrade to the latest fixed release of Yonyou KSOA when released by the vendor

👉 Official Vendor Portal (Patch / Upgrade Announcements):
https://www.yonyou.com/security

Final Takeaway

• These vulnerabilities allow remote, unauthenticated SQL injection
• Attackers can fully compromise backend databases
• Public exploit information exists and is actively discussed
• Detection is possible through logs, IDS, and WAF rules
• Immediate compensating controls are critical until patching
• Monitoring and proactive blocking are essential