CVE-2026-1131
Published: 19 January 2026
Summary
CVE-2026-1131 is a medium-severity Injection (CWE-74) vulnerability in Yonyou Ksoa. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2026-1131 is a SQL injection vulnerability in Yonyou KSOA 9.0, affecting an unknown function within the file /kmc/save_catalog.jsp of the HTTP GET Parameter Handler component. The flaw arises from improper handling of the 'catalogid' argument, allowing malicious SQL payloads to be injected. It is classified under CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection), with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and lack of prerequisites.
The vulnerability can be exploited remotely by unauthenticated attackers with no privileges required, low attack complexity, and no user interaction needed. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, such as extracting sensitive data, modifying database contents, or disrupting service to a minor extent through injected SQL commands via the manipulated 'catalogid' parameter.
Advisories from VulDB and a GitHub issue detail the vulnerability, noting that the exploit has been publicly disclosed and is available for use. No vendor response or patch is mentioned, as Yonyou was contacted early but provided no feedback.
In notable context, the public disclosure of the exploit increases the risk of real-world attacks against exposed Yonyou KSOA 9.0 instances.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3249
Vulnerability details
A vulnerability has been found in Yonyou KSOA 9.0. Impacted is an unknown function of the file /kmc/save_catalog.jsp of the component HTTP GET Parameter Handler. Such manipulation of the argument catalogid leads to sql injection. It is possible to launch…
more
the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of a public-facing web application via unauthenticated SQL injection in a JSP endpoint.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted inputs such as the catalogid GET parameter before they are used in SQL statements.
Boundary protection devices (e.g., WAF) can inspect HTTP requests and block or alert on SQL injection payloads targeting /kmc/save_catalog.jsp.
Continuous monitoring of application and database activity can identify anomalous queries or error patterns resulting from attempted SQL injection.