| शीर्षक | Yonyou KSOA V9.0 SQL Injection |
|---|
| विवरण | During the security assessment of KSOA, I discovered a critical SQL injection vulnerability in the "/worksheet/agent_work_report.jsp" file. The vulnerability exists because the application fails to properly sanitize the 'id' parameter before using it in a SQL statement. Remote attackers can exploit this by injecting malicious SQL commands (e.g., WAITFOR DELAY) to delay the response, confirming the injection and allowing for data exfiltration via blind SQL injection techniques. |
|---|
| स्रोत | ⚠️ https://github.com/master-abc/cve/issues/3 |
|---|
| उपयोगकर्ता | jiefengliang (UID 93721) |
|---|
| सबमिशन | 22/12/2025 06:16 PM (10 महीनों पहले) |
|---|
| संयम | 01/01/2026 07:21 PM (10 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 339342 [Yonyou KSOA 9.0 agent_work_report.jsp id SQL इंजेक्शन] |
|---|
| अंक | 0 |
|---|