CVE-2026-1120
Published: 18 January 2026
Summary
CVE-2026-1120 is a medium-severity Injection (CWE-74) vulnerability in Yonyou Ksoa. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-1120 is a SQL injection vulnerability in Yonyou KSOA 9.0. The affected component is the HTTP GET Parameter Handler, specifically an unknown function in the file /worksheet/del_work.jsp. The vulnerability arises from manipulation of the 'ID' argument in HTTP GET requests, enabling SQL injection.
The vulnerability is remotely exploitable by unauthenticated attackers (PR:N) with low attack complexity (AC:L) and no user interaction required (UI:N). Exploitation can result in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L), yielding a CVSS v3.1 base score of 7.3. It maps to CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection).
Public advisories on VulDB and a GitHub issue detail the vulnerability, noting that the exploit has been disclosed and may be used. The vendor was contacted early regarding disclosure but provided no response, and no patches or mitigations are referenced.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3175
Vulnerability details
A vulnerability has been found in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_work.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID leads to sql injection. The attack can…
more
be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated SQL injection in public web app component directly matches initial access via public-facing application exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted inputs such as the 'ID' HTTP GET parameter, preventing the SQL injection described in CVE-2026-1120.
Boundary protection mechanisms (e.g., WAF rules) can inspect and block malicious SQL syntax in remote HTTP requests to /worksheet/del_work.jsp before they reach the vulnerable handler.
Enforces strict access-control decisions on the del_work.jsp function, limiting which users or requests can supply the unsanitized 'ID' parameter that triggers the injection.