This vulnerability in Yonyou U8cloud 5.x involves an SQL injection in the OpenAPI component, specifically in the /u8cloud/openapi/so.saleorder.sendaudit endpoint. The issue arises from improper handling of the 'operator' argument, allowing an attacker to inject SQL commands remotely. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low complexity, no privileges required, and no user interaction needed. Public exploit details have been disclosed, but the vendor has not responded or provided a fix.

Successful exploitation allows remote attackers to perform SQL injection attacks, potentially leading to unauthorized data access or modification within the affected system. The vulnerability does not require privileges or user interaction, increasing its risk. However, the impact is rated medium severity, indicating limited or partial impact on confidentiality, integrity, or availability.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fixes are published, organizations should consider implementing application-layer protections such as input validation, web application firewalls (WAFs), or other SQL injection mitigations to reduce risk until an official fix is released. Monitor vendor advisories for updates.