YS-infoware BA-Workflow: SQL injection in workflow form platform
Summary
BA-Workflow, a workflow and form platform from YS-infoware, contains an SQL injection flaw caused by parameter injection. An authenticated attacker with standard (non-admin) privileges can run arbitrary SQL statements to read, modify and delete database contents. TWCERT rates the issue CVSS 4.0 8.7 (high), while VulDB rates it 6.3. The vendor remediation is an update to v3.6.2.7 or later.
Affected
- YS-infoware BA-Workflow versions before 3.6 (official CVE record and TWCERT)
- Conflicting information: OpenCVE lists all versions before v3.6.2.7 as affected. The exact boundary is unconfirmed.
Fixed in
- Update to BA-Workflow v3.6.2.7 or later (per TWCERT/CC advisory TVN-202610007).
- No vendor patch notes were found, so the release contents cannot be confirmed.
Workaround
Unknown. No interim mitigation is named in the sources.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in KEV (per Strix).
- Public proof of concept: none found.
- VulDB shows an undefined status and a '0-Day' label without explanation, so exploit status cannot be confirmed from it.
Our recommendation
- Check whether BA-Workflow is in use and which version runs, and treat versions below v3.6.2.7 as high priority.
- Check exposure first: restrict access to the application to required users and networks, and do not expose it directly to the internet.
- Review and remove unused accounts and check low-privilege accounts for compromise.
- Monitor database logs for unusual or malformed queries.
- Schedule the update to v3.6.2.7 or later and verify the installed version afterwards.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- TWCERT/CC advisory TVN-202610007 (English) www.twcert.org.tw
- TWCERT/CC advisory (Chinese) www.twcert.org.tw
- CHT Security advisory: SQL injection in workflow form platform www.chtsecurity.com
- CHT Security advisory: affected scope and remediation www.chtsecurity.com
- OpenCVE record CVE-2026-113406 app.opencve.io
- VulDB entry 422689 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:33.
Original description (NVD)
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.