Yonyou KSOA EUVD-2026-84252

Requires network reachability to a Yonyou KSOA 9.0 instance exposing the /cardcase/search_list.jsp endpoint; exploitation is performed by manipulating the 'address' request parameter. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed, so any attacker who can reach the JSP page can attempt it. Limiting factors: the target must be running the specific KSOA 9.0 product with this endpoint accessible (typically internal/enterprise deployments rather than broadly internet-facing), and the depth of impact depends on the privileges of the database account the application uses.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes an unauthenticated, low-complexity, network-reachable SQL injection, and the vendor-assigned base score of 6.9 with E:P reflects a proof-of-concept maturity. A public exploit exists (E:P and the description's explicit 'exploit has been made available to the public'), which raises practical risk above a theoretical finding - this is 'publicly available exploit code exists,' NOT confirmed active exploitation. No EPSS score and no CISA KEV listing were provided; absence of KEV plus the fact that the only reporting source is VulDB (a bulk crowd-sourced database, with the CVE, CTI, and submission entries all self-referential to vuldb.com) suggests this is not yet observed in widespread campaigns. The impact metrics are all rated Low (VC:L/VI:L/VA:L), consistent with a single-parameter SQLi yielding partial data disclosure/modification rather than full DB compromise, though real impact depends on the underlying DB account privileges - a classic SQLi could escalate to full read/write if the app uses an over-privileged DB user. Net: a real, actionable priority for anyone running Yonyou KSOA 9.0 (unauth + public PoC), tempered by an unpatched-but-niche product and no evidence of mass exploitation. Conflicting/missing signal to verify: EPSS and KEV data were not supplied, and vendor did not respond, so no official patch or affected-version confirmation exists beyond VulDB's claim of version 9.0.

A remote, unauthenticated attacker sends a crafted HTTP request to /cardcase/search_list.jsp with a malicious 'address' parameter that breaks out of the SQL query, extracting or altering database records. A public proof-of-concept exists, lowering the skill barrier and enabling opportunistic scanning-and-exploitation of internet-exposed KSOA 9.0 instances.