YS-infoware BA-Workflow: SQL injection via authenticated parameter input
Summary
BA-Workflow, a workflow and form platform from YS-infoware, contains an SQL injection vulnerability. An authenticated attacker with standard privileges can inject arbitrary SQL statements, allowing them to read, modify and delete database content. The attack requires a valid low-privilege account but no user interaction and can be carried out over the network.
Affected
- YS-infoware BA-Workflow prior to v3.6 (according to TWCERT advisory; affected range per CVE record: 0 to < v3.6)
Fixed in
- Update to BA-Workflow v3.6.2.7 or later.
Workaround
Unknown. No vendor workaround was found. Until patched, limit the database account used by BA-Workflow to the minimum rights required and restrict access to the application.
Exploitation
- CISA SSVC (Vulnrichment): exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV.
- No public exploit or evidence of in-the-wild exploitation found.
Our recommendation
- Check whether BA-Workflow is in use in your organisation and whether its web interface is reachable from the internet, VPN or partner networks.
- Update BA-Workflow to v3.6.2.7 or later on a normal-to-high priority schedule; prioritise internet-facing installations.
- Until patched, limit database account rights, remove unused accounts, restrict who holds BA-Workflow accounts and do not expose the admin interface to the internet.
- Monitor application and database logs for unusual SQL errors or data changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- TWCERT/CC advisory (English) www.twcert.org.tw
- TWCERT/CC advisory (Chinese) www.twcert.org.tw
- CHT Security advisory www.chtsecurity.com
- CHT Security advisory (affected scope) www.chtsecurity.com
- VulDB CVE-2026-113405 vuldb.com
- OpenCVE CVE-2026-113405 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:34.
Original description (NVD)
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.