CVE-2023-51927 is a critical SQL injection in the attendance script controller of Yonyou YonBIP v3_23.05, scored 9.8. A remote attacker can run SQL statements against the database. A distinct fixed build is not confirmed, so ask Yonyou for the patch and block outside access.
What's affected
CVE-2023-51927 affects YonBIP v3_23.05 from Yonyou. NVD published it on 2024-01-20 with a score of 9.8 (critical) and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD describes a SQL injection in the com.yonyou.hrcloud.attend.web.AttendScriptController.runScript() method. The reporter notes say the method connects to the database and runs the SQL statement carried in the script parameter.
The reporter's notes list the fixed version as YonBIP v3_23.05 (patched). That is the same label as the affected version, so it does not tell you which build contains the fix. Treat the fix status as unconfirmed and ask Yonyou for the exact patched build.
Five sibling CVEs were published against the same release on the same day: CVE-2023-51906, CVE-2023-51924, CVE-2023-51925, CVE-2023-51926, CVE-2023-51928. They are separate weaknesses in different components, so fixing one does not close the others. Ask for a patch that covers all six.
Weakness class: CWE-89.
How to check if you're exposed
Start with inventory. Find out whether you run YonBIP, and which release. The record names version 3_23.05, so any instance reporting that release is in scope until Yonyou says otherwise. Your vendor or integrator can tell you the build string from the product's admin or about page, because this is a commercial enterprise suite and I could not confirm a command-line check from the advisory.
Then check exposure. Most of the damage in this family comes from reaching the servlet endpoint over the network without logging in, so list every host that serves YonBIP and note whether it is reachable from the internet or only from an internal network. Your reverse proxy or load balancer logs show which paths receive traffic from outside.
If a web application firewall sits in front, review its logs for unexpected requests to the servlet path named in the advisory, and for new or modified files in the application's web directories. Unexpected files in those directories are the clearest sign that an upload flaw was used.
Database logs help here. If your database logs statements, look for statements issued by the application account that do not match normal application queries, especially anything that creates users, reads whole tables or calls system functions.
What to do now
- Confirm whether you run YonBIP v3_23.05 and record every instance, including test and staging copies.
- Contact Yonyou or your integrator and ask for the patched build and release notes for this CVE. Do not assume the label patched in the reporter notes means your build is fixed.
- Remove internet exposure. Put the application behind a VPN or an allow list of known source addresses until the patch is confirmed.
- Review web server and application logs since the product went live for requests to the affected component, and check web directories for files you did not deploy.
- If you find unexpected files, treat the host as compromised: isolate it, preserve logs, rotate credentials the application could read, and rebuild from a known good image.
- Apply least privilege to the database account the application uses. If it can only touch its own schema, the worst case from SQL injection is smaller.
Why it matters
This is classic CWE-89: the application builds a SQL statement from request data and runs it. The reporter notes add a second problem. The interface has a check on the Authorization header, but the notes say the expected value is derived from a request parameter, so the check can be satisfied by the caller. A check that the caller can compute is not an access control.
Put together, an endpoint that runs caller supplied SQL and guards itself with a computable token is reachable by anyone who can send it a request. Unauthenticated, network reachable flaws in enterprise business software are attractive because the product often holds finance, HR and supply chain data. The record's KEV flag is false, and I found no advisory stating exploitation in the wild, so this is a patch and exposure problem rather than a known active campaign.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this a parameterised query problem?
In part. The reporter notes say the method runs the SQL text from the script parameter directly, which is closer to an exposed SQL execution feature than a missed escape. Either way, the database sees attacker controlled statements.
What limits the damage if I cannot patch today?
Remove internet access, restrict the database account to the minimum it needs, and watch database logs for statements that do not look like the application's own.
Sources
Reporter notes for CVE-2023-51927 on GitHub (fetched, third party, not a vendor advisory)
NVD record for CVE-2023-51927 (the record this guide is built from)
Yonyou website (listed in the record; no advisory found there)
Last reviewed: 19 October 2026.
