{"id":"CVE-2026-113407","kind":"vulnerability","aliases":["CVE-2026-113407"],"related":[],"title":"BA-Workflow: SQL injection lets logged-in users read, change, or delete data","description":"BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.","summary":"BA-Workflow (YS-infoware) before 3.6.2.7 has a SQL injection (CWE-89). Any authenticated low-privilege user can run arbitrary SQL over the network to read, modify or delete database contents. CVSS 8.7 (v4), 8.8 (v3.1). Published 2026-10-20 via TWCERT/CC.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"BA-Workflow","fixed":["3.6.2.7"],"affected":"< 3.6.2.7","ecosystem":"vendor"}],"ecosystems":[],"tags":["ba-workflow","other","self-hosted","sql-injection","ys-infoware"],"not_affected_if":["auth-required","no-ba-workflow-installed"],"how_to_check":"Check the installed BA-Workflow version in the product's admin/about page or install directory; anything below 3.6.2.7 is affected. Exact location is unknown: ask YS-infoware.","fix":"Upgrade BA-Workflow to 3.6.2.7 or later (contact YS-infoware for the build). Until then, limit who has logins, restrict network access, and use a least-privilege database account.","status":"open","published_at":"2026-10-20T08:16:43+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:32:51+00:00","updated_at":"2026-10-24T00:16:59+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:32:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"BA-Workflow: SQL injection lets logged-in users read, change, or delete data","impact":"high","summary":"BA-Workflow, a workflow product from YS-infoware, has a SQL injection flaw. An attacker with a valid login can run arbitrary SQL to read, modify, or delete the database contents.","category":"other","who_cares":["ba-workflow","yS-infoware"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker reads, changes, or deletes the whole database contents","analyst_note":"Check the vendor advisory and JVN/NVD entry for affected versions and the fixed release; sources give no version or patch.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-ba-workflow-installed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000448,"input_tokens":2868,"output_tokens":323,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the vendor advisory and JVN/NVD entry for affected versions and the fixed release; sources give no version or patch.","search":"'-10':79B '-113407':18A,21A '-20':80B '-2026':17A,20A '-89':51B '2026':78B '3.6.2.7':45B '8.7':73B '8.8':75B 'arbitrari':60B,101C 'attack':98C 'authent':53B,96C 'ba':2A,23A,26B,39B,84C 'ba-workflow':1A,22A,25B,38B,83C 'chang':12A 'content':71B,110C 'cve':16A,19A 'cvss':72B 'cwe':50B 'data':15A 'databas':70B,109C 'delet':14A,69B,108C 'develop':86C 'host':31B 'infowar':37B,43B,90C 'inject':5A,34B,49B,94C,100C 'let':6A 'log':8A 'logged-in':7A 'low':55B 'low-privileg':54B 'modifi':67B,106C 'network':64B 'privileg':56B 'publish':77B 'read':11A,66B,105C 'remot':97C 'run':59B 'self':30B 'self-host':29B 'sql':4A,33B,48B,61B,93C,102C 'sql-inject':32B 'statement':103C 'twcert/cc':82B 'user':10A,57B 'v3.1':76B 'v4':74B 'via':81B 'vulner':95C 'workflow':3A,24A,27B,40B,85C 'ys':36B,42B,89C 'ys-infowar':35B,41B,88C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T08:16:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"twcert@cert.org.tw","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113407","severity":null,"published_at":"2026-10-20T08:16:43+00:00","modified_at":"2026-10-20T19:28:52+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113407:627","url":null,"severity":null,"published_at":"2026-10-24T00:16:59+00:00","modified_at":"2026-10-24T00:16:59+00:00","first_seen_at":"2026-10-24T00:16:59+00:00","fetched_at":"2026-10-24T00:16:59+00:00","note":"TWCERT TVN-202610007 and CVE record: CVE-2026-113407 affects BA-Workflow before 3.6.2.7 (sibling CVE-2026-113405/6 are before 3.6). No exploitation or public PoC found; no X/social search done (obscure Taiwanese product). Vendor's own page not found; fix version inferred from the CVE affected range. Feedly cites GHSA-84wj-3f7g-6wv4 for sibling 113405; unverified."}],"documents":[{"id":2521,"url":"https://www.twcert.org.tw/en/cp-139-11299-0cbfd-2.html","title":"TWCERT/CC TVN-202610007: YS-infoware BA-Workflow - 3 Vulnerabilities","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2525,"url":"https://www.cve.org/CVERecord?id=CVE-2026-113407","title":"CVE Record: CVE-2026-113407","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}