BA-Workflow, a workflow engine from YS-infoware, contains a SQL Injection flaw. The vulnerability allows an authenticated remote user to craft arbitrary SQL statements, which the application then executes against its underlying database. This can result in unauthorized disclosure, alteration, or deletion of data stored in the database, leading to serious confidentiality and integrity violations.

The affected product is YS-infoware BA‑Workflow. No specific version range is listed as affected, but a fix is available in version v3.6.2.7 and later.

The CVSS base score of 8.7 indicates a high risk classification, while the EPSS probability score of <1% suggests low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, and it requires authenticated remote access to exploit. Attackers with valid credentials can therefore leverage the flaw to control database contents.