{"id":"CVE-2026-113405","kind":"vulnerability","aliases":["CVE-2026-113405"],"related":[],"title":"BA-Workflow: SQL injection lets logged-in users read, change, delete data","description":"BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.","summary":"BA-Workflow (YS-infoware) before v3.6 has an SQL injection (CWE-89) that any logged-in user can use over the network to read, modify or delete database contents. CVSS 4.0 8.7 / 3.1 8.8. Reported by YuCheng Lin (Chtsecurity), published 2026-10-20 by TWCERT/CC. The vulnerable endpoint is not public. No known exploitation or public PoC.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"BA-Workflow","fixed":["3.6.2.7"],"affected":"< 3.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","ba-workflow","other","self-hosted","sql-injection","ys-infoware"],"not_affected_if":["auth-required","no-ba-workflow-installed"],"how_to_check":"Check your installed BA-Workflow version in the product's admin or about page. Anything below v3.6.2.7 should be treated as exposed. The advisory lists CVE-2026-113405 as affecting versions before v3.6, but the vendor fix is v3.6.2.7. Check whether the app is reachable from the internet or untrusted networks, since any login is enough to exploit it.","fix":"Update BA-Workflow to v3.6.2.7 or later (TWCERT/CC solution). Until then, limit access to the app to trusted networks and review accounts that can log in.","status":"open","published_at":"2026-10-20T08:16:42+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:32:52+00:00","updated_at":"2026-10-24T00:18:06+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:32:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"BA-Workflow: SQL injection lets logged-in users read, change, delete data","impact":"high","summary":"BA-Workflow, a workflow product from YS-infoware, has a SQL injection flaw. An authenticated remote attacker can inject SQL to read, modify, or delete database contents.","category":"other","who_cares":["ba-workflow","ys-infoware"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads, changes, or deletes all database contents.","analyst_note":"Check the NVD entry and the YS-infoware/JVN advisory for affected versions, the vulnerable endpoint, and the fixed release.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-ba-workflow-installed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00045,"input_tokens":2868,"output_tokens":326,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the YS-infoware/JVN advisory for affected versions, the vulnerable endpoint, and the fixed release.","search":"'-10':82B '-113405':17A,20A '-20':83B '-2026':16A,19A '-89':51B '2026':81B '3.1':73B '4.0':71B '8.7':72B '8.8':74B 'arbitrari':116C 'attack':113C 'authent':24B,111C 'ba':2A,22A,26B,39B,99C 'ba-workflow':1A,21A,25B,38B,98C 'chang':12A 'chtsecur':79B 'content':69B,125C 'cve':15A,18A 'cvss':70B 'cwe':50B 'data':14A 'databas':68B,124C 'delet':13A,67B,123C 'develop':101C 'endpoint':88B 'exploit':94B 'host':31B 'infowar':37B,43B,105C 'inject':5A,34B,49B,109C,115C 'known':93B 'let':6A 'lin':78B 'log':8A,55B 'logged-in':7A,54B 'modifi':65B,121C 'network':62B 'poc':97B 'public':91B,96B 'publish':80B 'read':11A,64B,120C 'remot':112C 'report':75B 'self':30B 'self-host':29B 'sql':4A,33B,48B,108C,117C 'sql-inject':32B 'statement':118C 'twcert/cc':85B 'use':59B 'user':10A,57B 'v3.6':45B 'vulner':87B,110C 'workflow':3A,23A,27B,40B,100C 'ys':36B,42B,104C 'ys-infowar':35B,41B,103C 'yucheng':77B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T08:16:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"twcert@cert.org.tw","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113405","severity":null,"published_at":"2026-10-20T08:16:42+00:00","modified_at":"2026-10-22T03:16:37+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113405:629","url":null,"severity":null,"published_at":"2026-10-24T00:18:06+00:00","modified_at":"2026-10-24T00:18:06+00:00","first_seen_at":"2026-10-24T00:18:06+00:00","fetched_at":"2026-10-24T00:18:06+00:00","note":"Read TWCERT/CC TVN-202610007 (primary CNA advisory) and CVE record. Affected <v3.6 per CVE; advisory solution says update to v3.6.2.7 or later (sibling CVE-2026-113407 is <3.6.2.7). Endpoint not disclosed. No exploitation or PoC found; social search skipped (niche Taiwanese product). Siblings CVE-2026-113406/113407 same advisory."}],"documents":[{"id":2521,"url":"https://www.twcert.org.tw/en/cp-139-11299-0cbfd-2.html","title":"TWCERT/CC TVN-202610007: YS-infoware BA-Workflow - 3 Vulnerabilities","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2539,"url":"https://www.cve.org/CVERecord?id=CVE-2026-113405","title":"CVE Record: CVE-2026-113405","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}