CVE-2026-1122 | Yonyou KSOA 9.0 HTTP GET Parameter /worksheet/work_info.jsp ID sql injection

A vulnerability, which was classified as critical, has been found in Yonyou KSOA 9.0. This impacts an unknown function of the file /worksheet/work_info.jsp of the component HTTP GET Parameter Handler. This manipulation of the argument ID causes sql injection.

This vulnerability appears as CVE-2026-1122. The attack may be initiated remotely. In addition, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.