A flaw has been found in Yonyou KSOA 9.0. This issue affects some unknown processing of the file /worksheet/worksadd_plan.jsp of the component HTTP GET Paramete…

A SQL injection vulnerability has been discovered in Yonyou KSOA 9.0, specifically affecting the /worksheet/worksadd_plan.jsp file through the HTTP GET Parameter Handler. The flaw allows remote attackers to manipulate the ID argument to execute SQL injection attacks. An exploit has been publicly published, making this vulnerability actively exploitable. The vendor was contacted about the disclosure but has not responded, leaving users vulnerable to potential attacks.