BA-Workflow, developed by YS-infoware, contains an SQL injection flaw that allows authenticated remote attackers to inject arbitrary SQL statements. Attackers can read, modify, and delete database contents, compromising data confidentiality, integrity, and availability. The vulnerability emerges when valid credentials are used to log into the application and interact with backend queries.

All versions of YS-infoware BA-Workflow prior to the release of v3.6.2.7 are affected. Any deployment of the product without the patch or an equivalent fix remains vulnerable.

The CVSS score of 8.7 indicates high severity. The EPSS score of less than 1% shows a low probability that the vulnerability is currently being exploited. The flaw is not listed in CISA KEV. Attack requires authenticated remote access, and the attacker must obtain legitimate credentials to the application. Because the attack vector is restricted, the overall risk is moderate, but the potential impact remains serious if credentials are compromised.