BA-Workflow CVE-2026-113405

Exploitation requires a valid authenticated session on BA-Workflow (CVSS PR:L), so the attacker must hold or obtain low-privilege application credentials - this is the primary limiting factor. Given AV:N/AC:L/AT:N/UI:N, once authenticated the attack is remote, low-complexity, needs no special configuration, and requires no victim interaction; the SQL injection appears reachable through normal authenticated application input rather than a non-default feature. The description does not name the specific vulnerable parameter, endpoint, or feature, so the exact injectable input is not confirmed from available data. No evidence that a non-default deployment mode is needed.

The input provides a CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scoring 8.7, indicating a network-reachable, low-complexity attack with no attack requirements, requiring low privileges (PR:L - i.e., an authenticated but not necessarily high-privileged account) and no user interaction, with high impact to confidentiality, integrity, and availability of the vulnerable system (no scope/subsequent-system impact). This is consistent with CWE-89 SQL Injection and the description, which states authenticated remote attackers can read, modify, and delete database contents. No EPSS score is provided, this CVE is not listed in CISA KEV, and no POC/exploit code is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is therefore moderated by two factors: (1) authentication is required (PR:L), so an attacker needs valid credentials or an account on the application, which narrows the attacker population to insiders, credential-phishing/stuffing success, or chained access; and (2) the affected product, BA-Workflow by YS-infoware, appears to be a niche, likely Taiwan-regional workflow product (reported by TWCERT), limiting the exposed attack surface across the global install base. Signals are internally consistent - there is no conflict between the CVSS vector and the description. The main uncertainty is the absence of EPSS/KEV/POC data, which means exploitation likelihood cannot be quantified; treat this as a genuine high-severity flaw for organizations actually running BA-Workflow, but not a broad, mass-exploitation priority given its limited footprint and authentication requirement.

An attacker with a valid low-privilege BA-Workflow account (or who has obtained credentials via phishing or reuse) sends a crafted request to a vulnerable application parameter over the network, injecting SQL that the backend executes against the database. Because the flaw grants read, modify, and delete access to database contents, the attacker can exfiltrate sensitive records, tamper with workflow data, or destroy tables. No public exploit code is identified at time of analysis, and no user interaction is required (AC:L/UI:N), so exploitation is straightforward once authenticated.