CVE-2026-1179
Published: 19 January 2026
Summary
CVE-2026-1179 is a medium-severity Injection (CWE-74) vulnerability in Yonyou Ksoa. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-1179 is a SQL injection vulnerability in Yonyou KSOA 9.0, affecting the HTTP GET Parameter Handler component specifically within the /kmf/user_popedom.jsp file. The issue arises from improper handling of the 'folderid' argument, allowing attackers to inject malicious SQL payloads. It is classified under CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection), with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its remote exploitability.
Unauthenticated remote attackers can exploit this vulnerability by sending crafted HTTP GET requests to the vulnerable endpoint with a manipulated 'folderid' parameter. Successful exploitation enables partial compromise of confidentiality, integrity, and availability, such as extracting sensitive data from the database, modifying records, or disrupting service, depending on the backend database privileges and configuration.
Advisories from VulDB and a related GitHub issue confirm the exploit is public and actively available for use. The vendor was notified early but has not responded or issued any patches, leaving affected systems without official mitigations; practitioners should implement input validation, web application firewalls, or restrict access to the endpoint until remediation is available.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3493
Vulnerability details
A vulnerability was detected in Yonyou KSOA 9.0. This affects an unknown part of the file /kmf/user_popedom.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument folderid results in sql injection. The attack can be launched remotely.…
more
The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated SQLi in public-facing web app endpoint enables initial access via exploitation of exposed application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the folderid HTTP GET parameter to block malicious SQL payloads before they reach the database.
Enables boundary protections such as WAF rules or network filtering to inspect and drop crafted requests targeting /kmf/user_popedom.jsp.
Limits database privileges granted to the application account so that a successful SQL injection yields only minimal data exposure or modification.