CVE-2026-1120: Yonyou KSOA HTTP GET Parameter del_work.jsp sql injection
A vulnerability has been found in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/delwork.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1120?
CVE-2026-1120 has been classified as a high-severity vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2026-1120?
To remediate CVE-2026-1120, sanitize and validate all input parameters in the affected del_work.jsp file to prevent SQL injection.
What systems are affected by CVE-2026-1120?
CVE-2026-1120 affects Yonyou KSOA version 9.0 specifically in the del_work.jsp file.
What type of vulnerability is CVE-2026-1120?
CVE-2026-1120 is classified as an SQL injection vulnerability resulting from improper handling of HTTP GET parameters.
Can CVE-2026-1120 be exploited remotely?
Yes, CVE-2026-1120 can be exploited remotely if an attacker can send crafted HTTP GET requests to the affected application.