CHT Security Discovered SQL Injection Vulnerability in the workflow form platform.

Summary:

The CHT Security Red Team discovered a vulnerability in the workflow form platform. This vulnerability involves parameter injection, which could lead to unauthorized SQL execution for reading, modifying, and deleting database content.

Detail:

In the workflow form platform, a remote attacker with standard privileges can exploit parameter injection to execute unauthorized SQL statements, allowing them to read, modify, and delete database content. This vulnerability falls under A05:2025 - Injection in the OWASP Top 10 (2025).

Credits:

YuCheng Lin