Cyber Resilience

CVE-2026-1133

Medium

Published: 19 January 2026

Published
19 January 2026
Modified
06 February 2026
KEV Added
Patch
CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0049 38.5th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-1133 is a medium-severity Injection (CWE-74) vulnerability in Yonyou Ksoa. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SC-7 (Boundary Protection).

Deeper analysis

CVE-2026-1133 is a SQL injection vulnerability affecting Yonyou KSOA 9.0. The issue resides in an unknown function within the file /kmf/folder.jsp, specifically in the HTTP GET Parameter Handler component. By manipulating the 'folderid' argument, attackers can trigger SQL injection, as identified under CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection). The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and lack of prerequisites.

The vulnerability enables remote exploitation without authentication or user interaction. Attackers can send crafted HTTP GET requests to the vulnerable endpoint, injecting malicious SQL payloads via the 'folderid' parameter. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling data exfiltration, modification of database records, or denial-of-service conditions within the application's scope.

Advisories from VulDB (ctiid.341723, id.341723, submit.734576) and a GitHub issue (LX-66-LX/cve/issues/16) detail the flaw, confirming the exploit has been publicly disclosed and is available for use. The vendor was notified early but provided no response, and no patches or mitigations are referenced in the available sources.

Notable context includes the public availability of the exploit, increasing the risk of active exploitation against unpatched Yonyou KSOA 9.0 instances exposed to the internet.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /kmf/folder.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument folderid can lead to sql injection. The attack…

more

can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct remote SQL injection in unauthenticated web endpoint (/kmf/folder.jsp) matches T1190 Exploit Public-Facing Application; limited DB impacts do not map to additional techniques.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-15436Same product: Yonyou Ksoa
CVE-2025-15421Same product: Yonyou Ksoa
CVE-2026-1130Same product: Yonyou Ksoa
CVE-2026-1120Same product: Yonyou Ksoa
CVE-2026-1122Same product: Yonyou Ksoa
CVE-2026-1124Same product: Yonyou Ksoa
CVE-2026-1121Same product: Yonyou Ksoa
CVE-2025-15424Same product: Yonyou Ksoa
CVE-2026-1178Same product: Yonyou Ksoa
CVE-2026-1177Same product: Yonyou Ksoa

Affected Assets

yonyou
ksoa
9.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation and sanitization of untrusted HTTP GET parameters such as folderid to block SQL injection payloads before they reach the database.

preventdetect

Boundary protection devices (e.g., WAF rules) can inspect and drop crafted requests to /kmf/folder.jsp containing malicious folderid values.

detect

Continuous monitoring of web-server and database logs can identify anomalous SQL syntax or error patterns indicative of attempted folderid injection.

References