RULE(RULE ID:339199)

Rule General Information
Release Date: 2025-06-25
Rule Name: Yonyou KSOA imagefield SQL Injection Vulnerability
Severity:
CVE ID:
Rule Protection Details
Description: Yoniu KSOA is a next-generation product developed under SOA principles, providing a unified IT infrastructure tailored to the cutting-edge needs of distribution enterprises, enabling seamless communication between IT systems built at different stages, helping protect existing IT investments, simplify IT management, enhance competitiveness, and ensure the achievement of strategic goals and innovation initiatives. The sKeyname parameter in the /servlet/imagefield interface has an SQL injection vulnerability that allows attackers to execute arbitrary commands via xp_cmdshell and gain server control.
Impact: An attacker can inject arbitrary sql commands to view or change the database of the target by exploiting the vulnerability successfully.
Affected OS: Windows, Linux, Others
Reference:
Solutions
Please contact the software vendor to update the software patch.