BA-Workflow CVE-2026-113407

Exploitation requires a valid authenticated session at low privilege (CVSS PR:L) to the BA-Workflow application - the attacker must already possess working credentials, which is the primary limiting factor. Beyond authentication, the attack is network-reachable (AV:N), low-complexity (AC:L), and requires no user interaction (UI:N), so any authenticated user able to reach an injectable input parameter can trigger it against default configurations. The description names no additional feature flag or non-default setting, so the condition is simply authenticated access to a request parameter that is passed unsanitized into a SQL query.

This is a CWE-89 SQL Injection in BA-Workflow (YS-infoware) reported by TWCERT (Taiwan's CERT). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates a network-reachable, low-complexity attack requiring low-level authentication (PR:L) with no user interaction and high impact to confidentiality, integrity, and availability - consistent with the description's claim that attackers can read, modify, and delete database contents. The 8.7 base score is genuinely high and technically credible for an authenticated injection flaw. However, several real-risk-dampening signals are present: no EPSS score was supplied, the CVE is NOT on CISA KEV, and no public proof-of-concept or exploit code is referenced - only two TWCERT advisory pages. The PR:L requirement means an attacker needs valid (even low-privilege) credentials, which materially limits opportunistic mass exploitation compared to a PR:N flaw. Net assessment: a legitimately severe flaw for organizations actually running BA-Workflow, but the absence of KEV/POC/EPSS evidence and the authentication prerequisite suggest this is not a broad internet-wide emergency; prioritize patching if the product is deployed and exposed to semi-trusted users.

An attacker who already holds a valid low-privilege BA-Workflow account submits a crafted request containing malicious SQL through an injectable parameter, bypassing input sanitization. Because VC:H/VI:H/VA:H apply, the injected statements let the attacker read, alter, or delete arbitrary database records. No public exploit code was identified at time of analysis, so exploitation currently requires the attacker to discover the vulnerable parameter independently.