CVE-2026-1129: Yonyou KSOA HTTP GET Parameter worksadd.jsp sql injection

Published Jan 19, 2026

Updated

A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/worksadd.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Yonyou KSOA

Yonyou KSOA=9.0

Event History

Jan 19, 2026

CVE Published

via MITRE·12:02 AM

Data Sourced

via MITRE·12:02 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:16 AM

DescriptionSeverityWeaknessAffected Software

Aug 21, 58082

Event

via NVD·11:32 AM

Frequently Asked Questions

What is the severity of CVE-2026-1129?

CVE-2026-1129 is classified as a high severity vulnerability due to its potential for SQL injection attacks.

How do I fix CVE-2026-1129?

To fix CVE-2026-1129, it is recommended to sanitize and validate all HTTP GET parameters, especially those interacting with SQL queries.

What versions of Yonyou KSOA are affected by CVE-2026-1129?

CVE-2026-1129 affects Yonyou KSOA version 9.0 specifically.

What component is vulnerable in CVE-2026-1129?

The vulnerable component in CVE-2026-1129 is the HTTP GET Parameter Handler associated with the worksadd.jsp file.

What type of attack can be executed using CVE-2026-1129?

CVE-2026-1129 allows attackers to perform SQL injection attacks through manipulation of the ID parameter.