Cyber Resilience

CVE-2026-1177

Medium

Published: 19 January 2026

Published
19 January 2026
Modified
05 February 2026
KEV Added
Patch
CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0036 27.7th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-1177 is a medium-severity Injection (CWE-74) vulnerability in Yonyou Ksoa. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SC-7 (Boundary Protection).

Deeper analysis

CVE-2026-1177 is a SQL injection vulnerability affecting Yonyou KSOA 9.0, specifically in an unknown functionality of the /kmf/save_folder.jsp file within the HTTP GET Parameter Handler component. The issue arises from improper handling of the 'folderid' argument, allowing attackers to manipulate it and inject malicious SQL payloads. Published on January 19, 2026, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and is associated with CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection).

The vulnerability can be exploited remotely by unauthenticated attackers with no privileges required, low attack complexity, and no user interaction needed. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, such as extracting sensitive data, modifying database contents, or disrupting service to a minor extent.

Advisories from VulDB (ctiid.341771, id.341771, submit.734577) and a GitHub issue (LX-66-LX/cve/issues/17) detail the flaw, with a public exploit available that could facilitate attacks. The vendor was notified early but provided no response, and no patches or mitigations are mentioned in the available references.

An exploit has been publicly disclosed, increasing the risk of real-world attacks against exposed Yonyou KSOA 9.0 instances.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

A weakness has been identified in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /kmf/save_folder.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument folderid can lead to sql injection.…

more

It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct remote exploitation of unauthenticated SQL injection in a public-facing web application component (/kmf/save_folder.jsp).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-15436Same product: Yonyou Ksoa
CVE-2025-15421Same product: Yonyou Ksoa
CVE-2026-1130Same product: Yonyou Ksoa
CVE-2026-1120Same product: Yonyou Ksoa
CVE-2026-1122Same product: Yonyou Ksoa
CVE-2026-1124Same product: Yonyou Ksoa
CVE-2026-1121Same product: Yonyou Ksoa
CVE-2025-15424Same product: Yonyou Ksoa
CVE-2026-1133Same product: Yonyou Ksoa
CVE-2026-1178Same product: Yonyou Ksoa

Affected Assets

yonyou
ksoa
9.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation and sanitization of untrusted inputs such as the folderid GET parameter to block SQL command injection.

prevent

Boundary protection devices (e.g., WAF rules) can inspect and drop HTTP requests containing SQL metacharacters targeting /kmf/save_folder.jsp.

detect

Continuous monitoring of web-server and database logs can identify anomalous SQL syntax or error patterns indicative of attempted injection.

References