Submeter #895364: Yonyou KSOA Yonyou KSOA (用友时空KSOA) 9.0 Yonyou Network Technology Co., Ltd. (https://www.yonyou.com/)

=== VulDB Submission ===

Title: Yonyou KSOA /cardcase/search_list.jsp SQL Injection

Product: Yonyou KSOA (用友时空KSOA)
Version: 9.0
Vendor: Yonyou Network Technology Co., Ltd. (https://www.yonyou.com/)

Vulnerability Type: SQL Injection (CWE-89)

Affected Component:
/cardcase/search_list.jsp - the "address" GET parameter

Description:
Yonyou KSOA (用友时空KSOA) is a collaborative office and enterprise management platform. The /cardcase/search_list.jsp interface has a SQL injection vulnerability in the "address" parameter. User-supplied input is directly concatenated into SQL queries without proper sanitization.

Impact:
An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, leading to data leakage, unauthorized database access, or server manipulation.

Detection:
Time-based blind SQL injection (WAITFOR DELAY).

Reproduction Steps:
1. Send a normal request:
GET /cardcase/search_list.jsp?address=12211
2. Send a time-based injection payload:
GET /cardcase/search_list.jsp?address=12211'waitfor+delay+'0:0:5'--+
3. If response time is >= 5 seconds, the vulnerability is confirmed.

PoC:
Goby PoC file included.

CVSS v3.1: 7.5 (High) - AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Remediation:
- Use parameterized queries or prepared statements
- Implement strict input validation for the "address" parameter
- Apply vendor patches when available

• Utilizador: mjh_123 (UID 92618)
• Submissão: 19/07/2026 10h46 (há 2 meses)
• Moderação: 21/09/2026 19h46 (2 months later)
• Estado: Aceite
• Entrada VulDB: 408191 [Yonyou KSOA 9.0 search_list.jsp address Injeção SQL]
• Pontos: 17