CVE-2026-1179 is a high-severity SQL injection (CVSS 7.3) in Yonyou KSOA 9.0. Changing the folderid argument of /kmf/user_popedom.jsp lets a remote attacker alter the database query, with no login required by the CVSS vector. No fixed version is listed and the vendor did not respond, so limit who can reach the application and check with the vendor.
What's affected
- Product: Yonyou KSOA 9.0.
- Vulnerable file:
/kmf/user_popedom.jsp, component: HTTP GET Parameter Handler. - Vulnerable argument:
folderid. - Fixed version: none listed. The record says the vendor was contacted early about the disclosure and did not respond.
- Weakness classes: CWE-74 (injection) and CWE-89 (SQL injection).
- Published: 19 January 2026. The CVSS vector shows network access, low complexity, no privileges and no user interaction.
- Exploitation: the record says an exploit has been publicly disclosed. The CVE is not in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is being exploited in the wild.
How to check if you're exposed
This is a web application, so a dependency scan will not find it. The check is about where it runs and who can reach it.
- Check your asset inventory for KSOA 9.0 hosts. Many teams do not know which departments run an internal office or knowledge management system until someone asks.
- From outside your network, see whether the host answers on
/kmf/user_popedom.jsp. A plain request with no parameters is enough. - Search web server and proxy logs for that path and look for odd
folderidvalues, such as quotes, SQL keywords or very long strings.
grep -F "/kmf/user_popedom.jsp" /var/log/nginx/access.log
What to do now
- Take
/kmf/user_popedom.jspoff the public internet, or restrict the whole application to a VPN. A deny rule at the reverse proxy is a reasonable stopgap if you confirm the rest of the application still works. - Review historical logs for the path and the
folderidargument. If you find suspicious requests, treat the database contents and the application database credentials as exposed and rotate the credentials. - Ask the vendor for a fixed build and watch the Gold entry for CVE-2026-1179 for updates. Do not assume a fix exists until the vendor says so.
Why it matters
The weakness is the classic one: input from the request is combined with SQL text instead of being passed as a bound parameter. Here that input is folderid, read from a GET request to user_popedom.jsp. The record tags both CWE-74 and CWE-89, the general injection class and its SQL form.
Quick check
Is there a patch for CVE-2026-1179?
Not that the record shows. The record lists no fixed version. The record says the vendor was contacted early about the disclosure and did not respond. Check directly with the vendor before assuming a fix exists.
Does a web application firewall make this safe?
It helps, but it is a filter in front of vulnerable code, not a repair. Treat it as one layer next to network restriction and log review.
Sources
- Gold entry and CVE record: CVE-2026-1179, published 19 January 2026.
- References listed in the record, not retrievable for this review: VulDB entry and the researcher issue.
Last reviewed: 19 October 2026.
