CVE-2025-15424 is a high severity SQL injection (CVSS 7.3) in Yonyou KSOA 9.0. The ID parameter of /worksheet/agent_worksdel.jsp reaches a database query unsafely, and the record says an exploit is public. The vendor did not respond to disclosure and no fix is confirmed, so restrict access to the JSP.
What's affected
The record lists Yonyou KSOA 9.0, an enterprise information integration platform, as affected. The vulnerable file is /worksheet/agent_worksdel.jsp, a worksheet page that deletes entries, in the HTTP GET parameter handler component. The unsafe input is ID.
This is one of seven KSOA SQL injection reports from the same disclosure round: CVE-2025-15420, CVE-2025-15421, CVE-2025-15425, CVE-2025-15434, CVE-2025-15435, CVE-2025-15436. They hit different JSP pages, so a block on one path does not cover the others.
The record states that the exploit is public and that the vendor was contacted early but did not respond. No fixed version appears in the record or in the public report I fetched. Plan around the product being unpatched.
How to check if you're exposed
KSOA runs as a Java web application, so check the web tier first.
- Look for the JSP on your servers:
find / -name "agent_worksdel.jsp" 2>/dev/null
- Search access logs for requests to
/worksheet/agent_worksdel.jspand read theIDvalues. Quote marks, SQL keywords or very long values are the signs to flag. - Check whether the KSOA host is reachable from the internet at all. A scan of your external address space for the application's login page answers that quickly.
- Check the database logs for syntax errors raised by queries from the application account.
If you cannot find any of these, confirm with your IT team whether KSOA is part of a managed suite someone else runs.
What to do now
- Take KSOA 9.0 off the public internet, or put it behind a VPN or an allowlist of known addresses.
- Add a web server or reverse proxy rule that denies requests to
/worksheet/agent_worksdel.jspfor everyone who does not need it. - Give the database account used by KSOA the lowest rights that still work, and remove access to unrelated schemas.
- Turn on request logging and alerting for the affected JSP paths and review the past weeks for odd values.
- Ask Yonyou or your KSOA reseller in writing for a patch status, and keep the answer for your records.
Why it matters
The record lists CWE-89, SQL Injection, and CWE-74, the broader injection class. The page builds a database query from the ID value without separating data from SQL, so a crafted value can change the query. Typical results in this class are reading rows the user should not see and changing or deleting records.
The vector is network based with no privileges and no interaction (7.3). The record does not list this CVE in CISA's Known Exploited Vulnerabilities catalog, so I make no claim of attacks in the wild beyond the public disclosure the record mentions. Unpatched, publicly documented bugs in internet facing business software tend to be found by scanners fast, which is why exposure is the thing to fix first.
Quick check
Is there a fixed version of KSOA for CVE-2025-15424?
The record names none and says the vendor did not respond. Use network restrictions and the path block while you wait for a patch.
Why list sibling CVEs on each post?
They come from the same product and disclosure. Each one is a separate page, so a fix or block for one does not cover the rest.
Sources
Last reviewed: 19 October 2026.
