SQL Injection Vulnerability in Yonyou KSOA 9.0
CVE-2026-1178
Key Information:
Badges
What is CVE-2026-1178?
A security flaw has been identified in Yonyou KSOA 9.0, specifically within the HTTP GET Parameter Handler component, which exposes the application to SQL injection risks. The vulnerability allows an attacker to manipulate the 'folderid' parameter through the endpoint /kmf/select.jsp. This can be exploited remotely, posing significant risks to the integrity and confidentiality of the database. Despite the early disclosure to the vendor, no response has been received, raising concerns about the potential for unauthorized access and data breaches.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
KSOA 9.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved