CVE-2026-113407: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in YS-infoware BA-Workflow

CVE-2026-113407 is a SQL Injection vulnerability in YS-infoware's BA-Workflow product. Authenticated remote attackers can exploit improper neutralization of special elements in SQL commands to execute arbitrary SQL statements. This can compromise the confidentiality, integrity, and availability of the database by allowing unauthorized read, write, or delete operations. The vulnerability affects all versions from 0 up to but excluding 3.6.2.7. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch link provided, and no known exploits in the wild have been reported.

Successful exploitation allows authenticated remote attackers to execute arbitrary SQL commands on the backend database. This can result in unauthorized disclosure, modification, or deletion of sensitive data stored in the database, potentially impacting the application's functionality and data integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and monitor for suspicious activity related to database queries. Avoid exposing the application to untrusted networks if possible.