CVE-2026-1122: Yonyou KSOA HTTP GET Parameter work_info.jsp sql injection

Published Jan 18, 2026

Updated

A vulnerability was determined in Yonyou KSOA 9.0. This impacts an unknown function of the file /worksheet/workinfo.jsp of the component HTTP GET Parameter Handler. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Yonyou KSOA

Yonyou KSOA=9.0

Event History

Jan 18, 2026

CVE Published

via MITRE·02:02 PM

Data Sourced

via MITRE·02:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-1122?

CVE-2026-1122 has been classified as a critical vulnerability due to its potential to allow unauthorized access to the database via SQL injection.

How do I fix CVE-2026-1122?

To fix CVE-2026-1122, validate and sanitize user input in the work_info.jsp file to prevent SQL injection attacks.

Which versions of Yonyou KSOA are affected by CVE-2026-1122?

CVE-2026-1122 affects Yonyou KSOA version 9.0 and potentially earlier versions.

What type of vulnerability is CVE-2026-1122?

CVE-2026-1122 is classified as an SQL injection vulnerability that targets HTTP GET parameters.

Can CVE-2026-1122 lead to data breaches?

Yes, CVE-2026-1122 can lead to data breaches by allowing attackers to execute unauthorized SQL queries against the database.