Yonyou SQL Injection Flaws

Unauthenticated SQL injection in Yonyou KSOA 9.0 lets remote attackers inject arbitrary SQL through the address parameter of the /cardcase/search_list.jsp endpoint, potentially reading or modifying database contents depending on the privileges of the database account the application uses. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no credentials or user interaction are required, so any host able to reach the JSP page can attempt exploitation, and publicly available exploit code exists. There is no indication of confirmed active exploitation (not in CISA KEV), and although the vendor was contacted early about the disclosure it did not respond, so no vendor-released patch has been identified at time of analysis.

Authenticated SQL injection in Yonyou U8cloud 5.x lets a low-privilege OpenAPI user inject arbitrary SQL through the 'operator' argument of the /u8cloud/openapi/so.saleorder.sendaudit endpoint, potentially exposing or altering data held in the application's backend database. Exploitation is remote and requires no user interaction, but does require a valid low-privilege OpenAPI account and network reachability to the OpenAPI component (CVSS 4.0 PR:L, confirmed by the CVSS:4.0 vector), so purely unauthenticated attack is not established by the available data. Publicly available exploit code exists - a Go proof-of-concept targeting this exact endpoint has been published on GitHub - and the vendor was contacted early but did not respond, so no vendor-released patch has been identified at time of analysis; the CVSS 4.0 base score of 5.3 is modest largely because all three impact dimensions were rated Low, whereas an independent assessment rates confidentiality impact as High (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).