CVE-2026-1124 | Yonyou KSOA 9.0 HTTP GET Parameter work_report.jsp ID sql injection

A vulnerability has been found in Yonyou KSOA 9.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /worksheet/work_report.jsp of the component HTTP GET Parameter Handler. Performing a manipulation of the argument ID results in sql injection.

This vulnerability is known as CVE-2026-1124. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.