CVE-2026-1123: Yonyou KSOA HTTP GET Parameter work_mod.jsp sql injection
A vulnerability was identified in Yonyou KSOA 9.0. Affected is an unknown function of the file /worksheet/workmod.jsp of the component HTTP GET Parameter Handler. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1123?
The severity of CVE-2026-1123 is classified as high due to its potential for SQL injection, which can allow attackers to manipulate the database.
How do I fix CVE-2026-1123?
To fix CVE-2026-1123, it is recommended to sanitize and validate all input parameters, particularly those handled by the work_mod.jsp component.
What components are affected by CVE-2026-1123?
CVE-2026-1123 affects the Yonyou KSOA version 9.0, specifically the work_mod.jsp file handling HTTP GET parameters.
Can CVE-2026-1123 be exploited remotely?
Yes, CVE-2026-1123 can be exploited remotely using crafted HTTP GET requests to trigger the SQL injection vulnerability.
What are the potential impacts of CVE-2026-1123?
The potential impacts of CVE-2026-1123 include unauthorized access to sensitive data and manipulation of the database, leading to data breaches.