| 제목 | Yonyou KSOA V9.0 SQL Injection |
|---|
| 설명 | A SQL injection vulnerability exists in the Yonyou Space-Time KSOA Platform v9.0. The vulnerability is located in the /worksheet/agent_worksadd.jsp file. The application accepts untrusted input via the id HTTP GET parameter and directly concatenates it into a backend SQL query without proper validation or parameterization. This allows an unauthenticated remote attacker to inject malicious SQL commands, leading to potential data leakage, unauthorized database access, or server manipulation. The backend database appears to be Microsoft SQL Server. |
|---|
| 원천 | ⚠️ https://github.com/master-abc/cve/blob/main/Yonyou%20Space-Time%20Enterprise%20Information%20Integration%20KSOA%20Platformworksheetagent_worksadd.jsp%20SQL%20injection.md |
|---|
| 사용자 | jiefengliang (UID 93721) |
|---|
| 제출 | 2025. 12. 22. AM 06:20 (4 개월 ago) |
|---|
| 모더레이션 | 2026. 01. 01. PM 12:04 (10 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 339343 [Yonyou KSOA 9.0 HTTP GET Parameter agent_worksadd.jsp 아이디 SQL 주입] |
|---|
| 포인트들 | 20 |
|---|