Product: Yonyou Space-Time Enterprise Information Integration KSOA Platform v9.0 Vendor Homepage: https://www.yonyou.com/ Vulnerable File: /worksheet/work_mod.jsp Version: v9.0 Vulnerability Type: SQL injection Root Cause: A SQL injection vulnerability was found in the '/worksheet/work_mod.jsp' file of the KSOA. The reason for this issue is that the application accepts untrusted input via the 'id' parameter and concatenates it directly into a SQL query without proper validation or parameterization. Impact: Attackers can exploit this SQL injection vulnerability to achieve unauthorized database access, sensitive data leakage, data tampering, and potentially gain administrative control over the database server. Reproduction command: python sqlmap.py -u "http://139.129.39.196:98/worksheet/work_mod.jsp?id=1" --dbms=mssql --batch --dbs Suggested Repair: 1. Use Prepared Statements 2. Input Validation 3. WAF Configuration 4. Error Handling