CVE-2025-15424: Yonyou KSOA HTTP GET Parameter agent_worksdel.jsp sql injection
A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /worksheet/agentworksdel.jsp of the component HTTP GET Parameter Handler. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15424?
CVE-2025-15424 is classified as a critical vulnerability due to its potential for remote SQL injection exploitation.
How do I fix CVE-2025-15424?
To fix CVE-2025-15424, update Yonyou KSOA to the latest version that addresses the SQL injection vulnerability.
What types of attacks can exploit CVE-2025-15424?
CVE-2025-15424 can be exploited through remote SQL injection attacks targeting the HTTP GET parameters.
Which versions of Yonyou KSOA are affected by CVE-2025-15424?
CVE-2025-15424 affects Yonyou KSOA version 9.0.
What are the potential impacts of CVE-2025-15424?
Exploitation of CVE-2025-15424 may lead to unauthorized database access, data leakage, or manipulation.