CVE-2025-15424 | Yonyou KSOA 9.0 HTTP GET Parameter agent_worksdel.jsp ID sql injection

A vulnerability classified as critical has been found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /worksheet/agent_worksdel.jsp of the component HTTP GET Parameter Handler. Performing manipulation of the argument ID results in sql injection.

This vulnerability is known as CVE-2025-15424. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.