YS-infoware BA-Workflow: SQL injection
Summary
BA-Workflow, a workflow form platform from YS-infoware, contains an SQL injection vulnerability (CWE-89) rated High. An authenticated user with a valid low-privileged account can inject arbitrary SQL statements, which allows reading, modifying and deleting database contents. No public exploit or in-the-wild exploitation is known.
Affected
- BA-Workflow versions prior to v3.6.2.7
- Sibling CVEs CVE-2026-113405 and CVE-2026-113406 have a different threshold (prior to v3.6) and are covered by the same fix
Fixed in
- Update to BA-Workflow v3.6.2.7 or later
Workaround
- No vendor workaround known.
- Restrict the database account used by BA-Workflow to the minimum permissions required (generic guidance, not a vendor fix).
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV.
- No public proof of concept known.
Our recommendation
- Update BA-Workflow to v3.6.2.7 or later as soon as possible where the product is in use.
- Check whether the BA-Workflow instance is reachable from outside and review which accounts exist, including unused ones.
- Restrict the database account of the application to the minimum required permissions.
- Monitor database logs for suspicious SQL queries until the update is applied.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- TWCERT/CC advisory (English) www.twcert.org.tw
- TWCERT/CC advisory (Chinese) www.twcert.org.tw
- OpenCVE CVE-2026-113407 app.opencve.io
- VulDB CVE-2026-113407 vuldb.com
- VulDB vulnerability 422690 vuldb.com
- Vulners CNNVD aggregation vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:34.
Original description (NVD)
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.