CVE-2026-1124 is a high-severity SQL injection (CVSS 7.3) in Yonyou KSOA 9.0. Changing the ID argument of /worksheet/work_report.jsp lets a remote attacker alter the database query, with no login required by the CVSS vector. No fixed version is listed and the vendor did not respond, so limit who can reach the application and check with the vendor.
What's affected
- Product: Yonyou KSOA 9.0.
- Vulnerable file:
/worksheet/work_report.jsp, component: HTTP GET Parameter Handler. - Vulnerable argument:
ID. - Fixed version: none listed. The record says the vendor was contacted early about the disclosure and did not respond.
- Weakness classes: CWE-74 (injection) and CWE-89 (SQL injection).
- Published: 18 January 2026. The CVSS vector shows network access, low complexity, no privileges and no user interaction.
- Exploitation: the record says an exploit has been publicly disclosed. The CVE is not in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is being exploited in the wild.
How to check if you're exposed
This is a web application, so a dependency scan will not find it. The check is about where it runs and who can reach it.
- Check your asset inventory for KSOA 9.0 hosts. Many teams do not know which departments run an internal office or knowledge management system until someone asks.
- From outside your network, see whether the host answers on
/worksheet/work_report.jsp. A plain request with no parameters is enough. - Search web server and proxy logs for that path and look for odd
IDvalues, such as quotes, SQL keywords or very long strings.
grep -F "/worksheet/work_report.jsp" /var/log/nginx/access.log
What to do now
- Take
/worksheet/work_report.jspoff the public internet, or restrict the whole application to a VPN. A deny rule at the reverse proxy is a reasonable stopgap if you confirm the rest of the application still works. - Review historical logs for the path and the
IDargument. If you find suspicious requests, treat the database contents and the application database credentials as exposed and rotate the credentials. - Ask the vendor for a fixed build and watch the Gold entry for CVE-2026-1124 for updates. Do not assume a fix exists until the vendor says so.
Why it matters
Parameterized queries remove this whole class of bug. When ID is concatenated into a query string, any character the database treats as syntax can change what the query does. The record places the flaw in /worksheet/work_report.jsp and says it can be reached remotely.
Quick check
Is there a patch for CVE-2026-1124?
Not that the record shows. The record lists no fixed version. The record says the vendor was contacted early about the disclosure and did not respond. Check directly with the vendor before assuming a fix exists.
Does a web application firewall make this safe?
It helps, but it is a filter in front of vulnerable code, not a repair. Treat it as one layer next to network restriction and log review.
Sources
- Gold entry and CVE record: CVE-2026-1124, published 18 January 2026.
- References listed in the record, not retrievable for this review: VulDB entry and the researcher issue.
Last reviewed: 19 October 2026.
