CVE-2025-15434
Published: 02 January 2026
Summary
CVE-2025-15434 is a medium-severity Injection (CWE-74) vulnerability in Yonyou Ksoa. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-15434 is a SQL injection vulnerability affecting Yonyou KSOA 9.0, specifically an unknown function in the file /kp/PrintZPYG.jsp. The issue arises from improper handling of the zpjhid parameter, allowing injection of malicious SQL payloads. It has a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and is associated with CWE-74 (injection) and CWE-89 (SQL injection). The vulnerability was published on 2026-01-02.
The vulnerability can be exploited remotely by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or denial of service within the application's database.
Advisories from VulDB and a GitHub issue detail the vulnerability but note no vendor response or patch availability despite early notification. The exploit is publicly available, increasing the risk of immediate exploitation attempts.
Notable context includes the public disclosure of the exploit code, with no reported real-world exploitation or relevance to AI/ML at this time.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-0700
Vulnerability details
A vulnerability was detected in Yonyou KSOA 9.0. Affected is an unknown function of the file /kp/PrintZPYG.jsp. The manipulation of the argument zpjhid results in sql injection. It is possible to launch the attack remotely. The exploit is now public…
more
and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app (/kp/PrintZPYG.jsp) directly enables remote unauthenticated exploitation of the application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the zpjhid parameter in PrintZPYG.jsp to block malicious SQL payloads before they reach the database.
Enforces least-privilege database accounts so that even a successful injection via the unauthenticated zpjhid parameter yields only limited confidentiality/integrity/availability impact.
Enables monitoring of application and database query patterns to identify anomalous inputs or SQL statements originating from the /kp/PrintZPYG.jsp endpoint.