CVE-2026-1132: Yonyou KSOA HTTP GET Parameter edit_folder.jsp sql injection
A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /kmf/editfolder.jsp of the component HTTP GET Parameter Handler. Performing a manipulation of the argument folderid results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1132?
CVE-2026-1132 is classified as a critical vulnerability due to its potential for SQL injection.
How do I fix CVE-2026-1132?
To fix CVE-2026-1132, sanitize and validate input parameters in the edit_folder.jsp file, specifically the folderid parameter.
What software is affected by CVE-2026-1132?
CVE-2026-1132 affects Yonyou KSOA versions starting from 9.0.
What kind of attack can be executed through CVE-2026-1132?
CVE-2026-1132 allows attackers to perform SQL injection attacks by manipulating the folderid parameter.
Is CVE-2026-1132 easily exploitable?
Yes, CVE-2026-1132 can be easily exploited if appropriate input validation measures are not implemented.