KSOA (9.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ksoa-9.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 22 Sep 2026 02:32:23 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCVE-2026-94491 SQL Injection in Yonyou KSOAhttps://feed.craftedsignal.io/briefs/2026-09-yonyou-ksoa-sqli/Tue, 22 Sep 2026 02:32:23 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-yonyou-ksoa-sqli/Yonyou KSOA 9.0 is vulnerable to unauthenticated remote SQL injection via the address argument in the /cardcase/search_list.jsp endpoint.CVE-2026-94491 is a critical SQL injection vulnerability discovered in Yonyou KSOA 9.0. The vulnerability resides within the /cardcase/search_list.jsp file, where the address argument fails to properly sanitize user-supplied input. An unauthenticated remote attacker can leverage this flaw to inject arbitrary SQL commands, potentially leading to unauthorized data exfiltration or modification within the application database. Public proof-of-concept exploit code is currently available, significantly increasing the risk of exploitation. As of the current disclosure date, the vendor has not responded to vulnerability reports or issued a security patch, leaving deployments exposed. Defenders should restrict network access to the affected web application components and monitor logs for anomalous SQL syntax patterns associated with this specific URI.

Impact

Successful exploitation of CVE-2026-94491 grants an attacker the ability to execute unauthorized database queries. This can lead to full compromise of the KSOA application database, resulting in the exfiltration of sensitive organizational data, manipulation of business records, or potential further compromise of the underlying server infrastructure if database permissions are misconfigured. Given the lack of a vendor patch, the impact remains elevated for all organizations utilizing Yonyou KSOA 9.0.

Recommendation

  • Monitor web server logs for requests to /cardcase/search_list.jsp containing SQL injection payloads within the address parameter.
  • Implement Web Application Firewall (WAF) rules to block suspicious HTTP requests targeting the /cardcase/search_list.jsp endpoint with typical SQL injection indicators (e.g., UNION, SELECT, OR, SLEEP).
  • Isolate the Yonyou KSOA application from the public internet if it does not require external access, or restrict access via IP whitelisting to known trusted networks.
  • Engage with the vendor's support channels to pressure the release of an official security update.
]]>highadvisorysql-injectionweb-applicationvulnerability