RULE(RULE ID:339143)

Rule General Information
Release Date: 2025-06-25
Rule Name: Yonyou U8 obr_zdybxd_check SQL Injection Vulnerability
Severity:
CVE ID:
Rule Protection Details
Description: Yonyou U8 is an integrated Enterprise Resource Planning (ERP) software designed to meet the complex management needs of medium to large enterprises, providing comprehensive functions such as financial management, supply chain, and manufacturing. The Yonyou U8 obr_zdybxd_check interface contains an SQL injection vulnerability caused by insufficient input parameter validation. Attackers can exploit this vulnerability by injecting malicious SQL statements into the application to perform unauthorized operations, leading to information leakage and potentially gaining server control.
Impact: An attacker can inject arbitrary sql commands to view or change the database of the target by exploiting the vulnerability successfully.
Affected OS: Windows, Linux, Others
Reference:
Solutions
Please contact the software vendor to update the software patch.