CVE-2025-15425
Published: 02 January 2026
Summary
CVE-2025-15425 is a medium-severity Injection (CWE-74) vulnerability in Yonyou Ksoa. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-15425 is a SQL injection vulnerability in Yonyou KSOA 9.0. The flaw affects an unknown function in the file /worksheet/del_user.jsp, specifically within the HTTP GET Parameter Handler component. Attackers can trigger the issue by manipulating the ID argument via HTTP GET requests, leading to improper SQL command execution.
Remote attackers can exploit this vulnerability without privileges (PR:N), user interaction (UI:N), or high complexity (AC:L), over the network (AV:N). Successful exploitation yields limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), with a CVSS v3.1 base score of 7.3. The vulnerability is associated with CWE-74 and CWE-89.
References, including GitHub entries with vulnerability details and proof-of-concept code, confirm the exploit has been publicly disclosed and may be utilized. VulDB advisories document the issue, but the vendor was contacted early without any response, and no patches or mitigations are specified.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-0715
Vulnerability details
A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_user.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack…
more
can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app (/worksheet/del_user.jsp) directly enables remote exploitation of the application without auth or interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the ID HTTP GET parameter before it is used in SQL statements, blocking the injection vector in del_user.jsp.
Limits the database account privileges used by the application so that even a successful SQL injection yields only minimal confidentiality/integrity/availability impact.
Enables monitoring of database or web-server logs for anomalous SQL syntax or unexpected query patterns originating from the /worksheet/del_user.jsp endpoint.