CVE-2025-14185
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A vulnerability was identified in Yonyou U8 Cloud versions 5.0, 5.0sp, 5.1, and 5.1sp, where manipulation of the usercode argument in the file nc/pubitf/erm/mobile/appservice/AppServletService.class leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available. The vendor was contacted but did not respond.
Risk Assessment
An attacker could remotely execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion. Since the exploit is publicly available, the risk of exploitation is high.
Recommendation
Update Yonyou U8 Cloud to a patched version as soon as possible or apply mitigations (e.g., input validation, WAF). Until then, consider restricting access to the API interface.
Other vulnerabilities in Yonyou U8 Cloud
See all- CVE-2023-54398Critical
Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.
- CVE-2025-12344Medium
A vulnerability has been found in Yonyou U8 Cloud up to 5.1sp. The impacted element is an unknown function of the file /service/NCloudGatewayServlet in the Request Header Handler component. Manipulation of the ts/sign argument leads to unrestricted upload, and the attack may be performed remotely.
Original NVD description (English source)
A vulnerability was identified in Yonyou U8 Cloud 5.0/5.0sp/5.1/5.1sp. The affected element is an unknown function of the file nc/pubitf/erm/mobile/appservice/AppServletService.class. Such manipulation of the argument usercode leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS