Yonyou U8cloud EUVD-2026-84254

Requires a valid low-privilege OpenAPI account on Yonyou U8cloud 5.x (CVSS PR:L) with network reach to the /u8cloud/openapi/so.saleorder.sendaudit endpoint of the OpenAPI component; the attacker manipulates the 'operator' argument to inject SQL. No user interaction is needed (UI:N). Limiting factors: the OpenAPI interface and its authentication must be reachable by the attacker, and a functional low-privilege token or account is a prerequisite, so purely unauthenticated exploitation is not established by the provided vector.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) yields a modest 5.3 base score, driven down by the vendor's decision to rate all three impact dimensions as Low despite this being a SQL injection flaw - a class that typically enables full database read. The vector requires network access with low but non-zero privileges (PR:L), meaning a valid low-level OpenAPI account is needed, which meaningfully limits blast radius versus a pre-auth flaw. The exploitation maturity is flagged E:P (Proof-of-Concept), consistent with the publicly available Go exploit on GitHub, so this is 'publicly available exploit code exists' - NOT confirmed active exploitation. There is no CISA KEV listing and no EPSS score in the provided data, so widespread automated exploitation cannot be substantiated from these signals. The main data-quality caveat: the only source is VulDB (self-referencing links) plus one third-party POC repo; there is no vendor advisory (vendor explicitly did not respond) and no independent confirmation of affected sub-versions beyond '5.x'. My independent judgment is that the vendor's uniform Low impact understates a typical SQLi, which usually permits substantial data disclosure - verify actual injection depth against the POC before finalizing severity.

An attacker holding a low-privilege OpenAPI credential on a Yonyou U8cloud 5.x instance sends a crafted request to /u8cloud/openapi/so.saleorder.sendaudit with a malicious 'operator' parameter, injecting SQL that the backend executes against the ERP database. A public proof-of-concept exploit (mjh134/--POC Go script) already demonstrates the injection, lowering the skill barrier to reproduce data extraction from sales-order and related tables.