Cyber Resilience

CVE-2025-15425

MediumPublic PoC

Published: 02 January 2026

Published
02 January 2026
Modified
23 February 2026
KEV Added
Patch
CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0048 37.6th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-15425 is a medium-severity Injection (CWE-74) vulnerability in Yonyou Ksoa. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).

Deeper analysis

CVE-2025-15425 is a SQL injection vulnerability in Yonyou KSOA 9.0. The flaw affects an unknown function in the file /worksheet/del_user.jsp, specifically within the HTTP GET Parameter Handler component. Attackers can trigger the issue by manipulating the ID argument via HTTP GET requests, leading to improper SQL command execution.

Remote attackers can exploit this vulnerability without privileges (PR:N), user interaction (UI:N), or high complexity (AC:L), over the network (AV:N). Successful exploitation yields limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), with a CVSS v3.1 base score of 7.3. The vulnerability is associated with CWE-74 and CWE-89.

References, including GitHub entries with vulnerability details and proof-of-concept code, confirm the exploit has been publicly disclosed and may be utilized. VulDB advisories document the issue, but the vendor was contacted early without any response, and no patches or mitigations are specified.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_user.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack…

more

can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

SQL injection in public-facing web app (/worksheet/del_user.jsp) directly enables remote exploitation of the application without auth or interaction.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-15436Same product: Yonyou Ksoa
CVE-2025-15421Same product: Yonyou Ksoa
CVE-2026-1130Same product: Yonyou Ksoa
CVE-2026-1120Same product: Yonyou Ksoa
CVE-2026-1122Same product: Yonyou Ksoa
CVE-2026-1124Same product: Yonyou Ksoa
CVE-2026-1121Same product: Yonyou Ksoa
CVE-2025-15424Same product: Yonyou Ksoa
CVE-2026-1133Same product: Yonyou Ksoa
CVE-2026-1178Same product: Yonyou Ksoa

Affected Assets

yonyou
ksoa
9.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation and sanitization of the ID HTTP GET parameter before it is used in SQL statements, blocking the injection vector in del_user.jsp.

prevent

Limits the database account privileges used by the application so that even a successful SQL injection yields only minimal confidentiality/integrity/availability impact.

detect

Enables monitoring of database or web-server logs for anomalous SQL syntax or unexpected query patterns originating from the /worksheet/del_user.jsp endpoint.

References