CVE-2025-15421: Yonyou KSOA HTTP GET Parameter agent_worksadd.jsp sql injection

Published Jan 2, 2026

Updated

A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/agentworksadd.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Yonyou KSOA

Yonyou KSOA=9.0

Event History

Jan 2, 2026

CVE Published

via MITRE·01:02 AM

Data Sourced

via MITRE·01:02 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-15421?

CVE-2025-15421 has a high severity rating due to its potential for remote SQL injection exploits.

How do I fix CVE-2025-15421?

To fix CVE-2025-15421, update Yonyou KSOA to the latest version that addresses this SQL injection vulnerability.

What component is affected by CVE-2025-15421?

CVE-2025-15421 affects the HTTP GET Parameter Handler component in the file /worksheet/agent_worksadd.jsp.

Can CVE-2025-15421 be exploited remotely?

Yes, CVE-2025-15421 can be exploited remotely, allowing attackers to execute SQL injection attacks.

What type of vulnerability is CVE-2025-15421?

CVE-2025-15421 is classified as an SQL injection vulnerability.