Vulnerability details
CVE-2015-20122
Yonyou A6 OA
Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jsp
CVSS 4.0
8.7High
Official description
Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach_ids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject UNION-based SQL statements through the attach_ids request parameter in downloadAtt.jsp to retrieve sensitive information including credentials and system configuration data. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.7High | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Yonyou | A6 OA | All | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://qkl.seebug.org/vuldb/ssvid-89642 third-party-advisory
- https://www.vulncheck.com/advisories/seeyon-a6-oa-unauthenticated-sql-injection-via-downloadatt-jsp third-party-advisory
- https://www.ddpoc.com/poc/DVB-2021-2211.html third-party-advisory
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-29
- Last updated
- 2026-09-29
- State
- Published
- Assigner (CNA)
- VulnCheck
Exploit prediction (EPSS)
0.47%
Probability of exploitation in 30 days
41.2%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')