CVE-2025-15425 | Yonyou KSOA 9.0 HTTP GET Parameter /worksheet/del_user.jsp ID sql injection

A vulnerability classified as critical was found in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_user.jsp of the component HTTP GET Parameter Handler. Executing manipulation of the argument ID can lead to sql injection.

This vulnerability is handled as CVE-2025-15425. The attack can be executed remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.