YS-infoware BA-Workflow SQL Injection Enables Authenticated Users to Delete Database Records

YS-infoware BA-Workflow contains a SQL injection vulnerability that exposes database integrity to authenticated remote attackers. This flaw allows malicious actors to inject arbitrary SQL statements, enabling them to read, modify, or delete sensitive database contents. Security operations teams using this workflow automation tool must verify their version status immediately, as the issue affects releases prior to version 3.6. The National Vulnerability Database records this issue under CVE-2026-113406.

Root cause

The underlying weakness is classified as CWE-89, which denotes SQL injection. This occurs when the application fails to properly sanitize user-supplied input before incorporating it into SQL queries. Consequently, an attacker can alter the intended logic of the database command. The flaw exists within the application, allowing injected code to execute and affect database contents.

Attack path

An attacker must first obtain valid credentials to access the BA-Workflow interface. Once authenticated, they can submit crafted input containing SQL commands through vulnerable application fields. These commands are then processed by the backend database. The attacker can subsequently exfiltrate data, alter existing records, or delete critical information. The remote nature of the exploit means the attacker does not need local access to the server hosting the application.

Affected versions

• YS-infoware BA-Workflow versions before 3.6 are affected by this vulnerability.
• Version 3.6 and later are not listed as affected in the current advisory.
• Any instance running a pre-3.6 release is considered at risk.

Mitigation

• Upgrade YS-infoware BA-Workflow to version 3.6 or later to resolve the issue.
• Restrict database user privileges to limit the impact of potential injection.
• Implement web application firewalls to detect and block common SQL injection patterns.
• Audit application logs for unusual database query activity from authenticated users.

Signals worth monitoring

Teams usually detect this activity by reviewing database audit logs for unexpected query structures or high-volume read operations. Check whether application logs show successful logins followed immediately by complex or malformed input submissions. Look for alerts indicating unauthorized data modification or deletion events. Verify that database integrity checks have not flagged anomalies. Monitor for sudden spikes in database resource usage during off-hours. Ensure that alerting rules capture failed authentication attempts combined with suspicious payload signatures. Review access patterns for accounts that rarely interact with specific data tables.

What to do and how to stay safe: YS-infoware

• Inventory all instances of YS-infoware BA-Workflow to identify versions prior to 3.6.
• Apply the vendor update to version 3.6 or later as soon as it is available.
• Review database audit logs for signs of unauthorized data access or modification.
• Implement strict input validation and parameterised queries in custom integrations.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-113406?

The National Vulnerability Database assigns a CVSS score of 8.7, which is rated as High severity.

Does this vulnerability require authentication?

Yes, the source material states that attackers must be authenticated to exploit this SQL injection flaw.

Which versions of BA-Workflow are affected?

All versions of YS-infoware BA-Workflow prior to version 3.6 are affected by this vulnerability.