CVE-2026-1130: Yonyou KSOA HTTP GET Parameter worksadd_plan.jsp sql injection

Published Jan 19, 2026

Updated

A flaw has been found in Yonyou KSOA 9.0. This issue affects some unknown processing of the file /worksheet/worksaddplan.jsp of the component HTTP GET Parameter Handler. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Yonyou KSOA

Yonyou KSOA=9.0

Event History

Jan 19, 2026

CVE Published

via MITRE·12:32 AM

Data Sourced

via MITRE·12:32 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:16 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-1130?

CVE-2026-1130 has been classified with high severity due to its potential for SQL injection attacks.

How does CVE-2026-1130 exploit work?

CVE-2026-1130 exploits a SQL injection vulnerability in the worksadd_plan.jsp file by manipulating HTTP GET parameters.

Which versions of Yonyou KSOA are affected by CVE-2026-1130?

CVE-2026-1130 affects Yonyou KSOA versions prior to the patch addressing this SQL injection issue.

How do I fix CVE-2026-1130?

To fix CVE-2026-1130, apply the latest security patches provided by Yonyou for the KSOA platform.

What are the potential impacts of CVE-2026-1130?

CVE-2026-1130 can lead to unauthorized database access, data manipulation, or disclosure of sensitive information.