U8Cloud
Monthly
Authenticated SQL injection in Yonyou U8cloud 5.x lets a low-privilege OpenAPI user inject arbitrary SQL through the 'operator' argument of the /u8cloud/openapi/so.saleorder.sendaudit endpoint, potentially exposing or altering data held in the application's backend database. Exploitation is remote and requires no user interaction, but does require a valid low-privilege OpenAPI account and network reachability to the OpenAPI component (CVSS 4.0 PR:L, confirmed by the CVSS:4.0 vector), so purely unauthenticated attack is not established by the available data. Publicly available exploit code exists - a Go proof-of-concept targeting this exact endpoint has been published on GitHub - and the vendor was contacted early but did not respond, so no vendor-released patch has been identified at time of analysis; the CVSS 4.0 base score of 5.3 is modest largely because all three impact dimensions were rated Low, whereas an independent assessment rates confidentiality impact as High (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Authenticated SQL injection in Yonyou U8cloud 5.x lets a low-privilege OpenAPI user inject arbitrary SQL through the 'operator' argument of the /u8cloud/openapi/so.saleorder.sendaudit endpoint, potentially exposing or altering data held in the application's backend database. Exploitation is remote and requires no user interaction, but does require a valid low-privilege OpenAPI account and network reachability to the OpenAPI component (CVSS 4.0 PR:L, confirmed by the CVSS:4.0 vector), so purely unauthenticated attack is not established by the available data. Publicly available exploit code exists - a Go proof-of-concept targeting this exact endpoint has been published on GitHub - and the vendor was contacted early but did not respond, so no vendor-released patch has been identified at time of analysis; the CVSS 4.0 base score of 5.3 is modest largely because all three impact dimensions were rated Low, whereas an independent assessment rates confidentiality impact as High (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).