CVE-2026-1133: Yonyou KSOA HTTP GET Parameter folder.jsp sql injection

Published Jan 19, 2026

Updated

A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /kmf/folder.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument folderid can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Yonyou KSOA

Yonyou KSOA=9.0

Event History

Jan 19, 2026

CVE Published

via MITRE·02:02 AM

Data Sourced

via MITRE·02:02 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-1133?

CVE-2026-1133 has a high severity rating due to its potential for SQL injection attacks.

How do I fix CVE-2026-1133?

To fix CVE-2026-1133, ensure that inputs passed to the folderid parameter are properly sanitized and validated.

What software is affected by CVE-2026-1133?

CVE-2026-1133 affects Yonyou KSOA version 9.0.

What type of vulnerability is CVE-2026-1133?

CVE-2026-1133 is classified as an SQL injection vulnerability.

Can CVE-2026-1133 lead to data compromise?

Yes, CVE-2026-1133 can allow attackers to manipulate SQL queries, potentially leading to unauthorized data access.