CVE-2026-1133
Published: 19 January 2026
Summary
CVE-2026-1133 is a medium-severity Injection (CWE-74) vulnerability in Yonyou Ksoa. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2026-1133 is a SQL injection vulnerability affecting Yonyou KSOA 9.0. The issue resides in an unknown function within the file /kmf/folder.jsp, specifically in the HTTP GET Parameter Handler component. By manipulating the 'folderid' argument, attackers can trigger SQL injection, as identified under CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection). The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and lack of prerequisites.
The vulnerability enables remote exploitation without authentication or user interaction. Attackers can send crafted HTTP GET requests to the vulnerable endpoint, injecting malicious SQL payloads via the 'folderid' parameter. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling data exfiltration, modification of database records, or denial-of-service conditions within the application's scope.
Advisories from VulDB (ctiid.341723, id.341723, submit.734576) and a GitHub issue (LX-66-LX/cve/issues/16) detail the flaw, confirming the exploit has been publicly disclosed and is available for use. The vendor was notified early but provided no response, and no patches or mitigations are referenced in the available sources.
Notable context includes the public availability of the exploit, increasing the risk of active exploitation against unpatched Yonyou KSOA 9.0 instances exposed to the internet.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3248
Vulnerability details
A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /kmf/folder.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument folderid can lead to sql injection. The attack…
more
can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote SQL injection in unauthenticated web endpoint (/kmf/folder.jsp) matches T1190 Exploit Public-Facing Application; limited DB impacts do not map to additional techniques.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted HTTP GET parameters such as folderid to block SQL injection payloads before they reach the database.
Boundary protection devices (e.g., WAF rules) can inspect and drop crafted requests to /kmf/folder.jsp containing malicious folderid values.
Continuous monitoring of web-server and database logs can identify anomalous SQL syntax or error patterns indicative of attempted folderid injection.