CVE-2026-113406: YS-infoware｜BA-Workflow - SQL Injection
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YS-infoware BA-Workflowto a version that resolves this vulnerability.Fixed in v3.6.2.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to BA-Workflow and able to reach the affected service remotely. No user interaction is required.
What could an attacker do after exploiting it?
The attacker can inject arbitrary SQL statements, allowing them to read, modify, or delete database contents. The reported impact includes compromise of confidentiality, integrity, and availability.
Are unauthenticated or default deployments known to be affected?
The available information identifies authenticated attackers as the required threat actor. It does not state whether unauthenticated access or any particular default configuration is affected.