RULE(RULE ID:339189)

Rule General Information
Release Date: 2025-06-25
Rule Name: Yonyou NC-Cloud queryPsnInfo SQL Injection Vulnerability
Severity:
CVE ID:
Rule Protection Details
Description: YonYou NC-Cloud is a large-scale enterprise digital platform developed by YonYou, built on a cloud-native architecture and deeply integrated with next-generation digital intelligence technologies, designed to facilitate digital transformation for large enterprises. It offers a comprehensive suite of solutions covering digital marketing, financial sharing, smart manufacturing, agile supply chains, and talent management, empowering businesses to achieve efficient operations in a cloud-based environment. The queryPsnInfo interface in the YonYou NC-Cloud system is vulnerable to SQL injection, which enables attackers to manipulate the database by executing maliciously crafted SQL statements. This vulnerability could lead to data breaches, unauthorized modifications, or data destruction, posing a severe threat to system security.
Impact: An attacker can inject arbitrary sql commands to view or change the database of the target by exploiting the vulnerability successfully.
Affected OS: Windows, Linux, Others
Reference:
Solutions
Please contact the software vendor to update the software patch.