CVE-2026-1129
Published: 19 January 2026
Summary
CVE-2026-1129 is a medium-severity Injection (CWE-74) vulnerability in Yonyou Ksoa. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2026-1129 is a SQL injection vulnerability in Yonyou KSOA 9.0, affecting unknown code within the file /worksheet/worksadd.jsp handled by the HTTP GET Parameter Handler component. The issue arises from manipulation of the 'ID' argument in HTTP GET requests, enabling improper neutralization of special elements used in an SQL command, as classified under CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection). It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), rated as high severity.
Remote attackers without authentication can exploit this vulnerability by sending crafted GET requests to the affected endpoint, injecting malicious SQL payloads via the 'ID' parameter. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, such as extracting sensitive data, modifying database contents, or disrupting service to a low degree.
Advisories from VulDB (ctiid.341719, id.341719, submit.734557) and a GitHub issue (LX-66-LX/cve/issues/11) detail the vulnerability, noting that a public exploit is available. The vendor was contacted early but provided no response, and no patches or mitigations are mentioned in the available references.
The exploit's public availability increases the risk of widespread abuse against unpatched Yonyou KSOA 9.0 instances exposed to the internet.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3251
Vulnerability details
A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/worksadd.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID results in sql injection. The attack may be performed from…
more
remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated SQL injection in a public-facing web endpoint (/worksheet/worksadd.jsp) matches T1190 Exploit Public-Facing Application; limited DB read/write/disrupt impacts do not reliably map additional techniques.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the untrusted 'ID' HTTP GET parameter before it is used in SQL statements, blocking the injection vector in worksadd.jsp.
Boundary protection devices (e.g., WAF rules) can inspect and drop crafted GET requests containing SQL metacharacters targeting the exposed /worksheet/worksadd.jsp endpoint.
Continuous monitoring of web/application logs can identify anomalous SQL syntax or error patterns originating from remote unauthenticated requests to the vulnerable parameter.