CVE-2026-1178 is a high-severity SQL injection (CVSS 7.3) in Yonyou KSOA 9.0. Changing the folderid argument of /kmf/select.jsp lets a remote attacker alter the database query, with no login required by the CVSS vector. No fixed version is listed and the vendor did not respond, so limit who can reach the application and check with the vendor.
What's affected
- Product: Yonyou KSOA 9.0.
- Vulnerable file:
/kmf/select.jsp, component: HTTP GET Parameter Handler. - Vulnerable argument:
folderid. - Fixed version: none listed. The record says the vendor was contacted early about the disclosure and did not respond.
- Weakness classes: CWE-74 (injection) and CWE-89 (SQL injection).
- Published: 19 January 2026. The CVSS vector shows network access, low complexity, no privileges and no user interaction.
- Exploitation: the record says an exploit has been publicly disclosed. The CVE is not in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is being exploited in the wild.
How to check if you're exposed
This is a web application, so a dependency scan will not find it. The check is about where it runs and who can reach it.
- Check your asset inventory for KSOA 9.0 hosts. Many teams do not know which departments run an internal office or knowledge management system until someone asks.
- From outside your network, see whether the host answers on
/kmf/select.jsp. A plain request with no parameters is enough. - Search web server and proxy logs for that path and look for odd
folderidvalues, such as quotes, SQL keywords or very long strings.
grep -F "/kmf/select.jsp" /var/log/nginx/access.log
What to do now
- Take
/kmf/select.jspoff the public internet, or restrict the whole application to a VPN. A deny rule at the reverse proxy is a reasonable stopgap if you confirm the rest of the application still works. - Review historical logs for the path and the
folderidargument. If you find suspicious requests, treat the database contents and the application database credentials as exposed and rotate the credentials. - Ask the vendor for a fixed build and watch the Gold entry for CVE-2026-1178 for updates. Do not assume a fix exists until the vendor says so.
Why it matters
SQL injection happens when text from a request is placed straight into a database query, so the database treats part of the input as instructions. The folderid argument is read from the HTTP request and reaches a query without being kept separate from the query text. The record does not publish the query itself, and neither do we.
Quick check
Is there a patch for CVE-2026-1178?
Not that the record shows. The record lists no fixed version. The record says the vendor was contacted early about the disclosure and did not respond. Check directly with the vendor before assuming a fix exists.
Does a web application firewall make this safe?
It helps, but it is a filter in front of vulnerable code, not a repair. Treat it as one layer next to network restriction and log review.
Sources
- Gold entry and CVE record: CVE-2026-1178, published 19 January 2026.
- References listed in the record, not retrievable for this review: VulDB entry and the researcher issue.
Last reviewed: 19 October 2026.
