EUVD-2026-34984
GHSA-44h7-ppq3-383m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in Tiobon Employee Self-Service System up to 7.2. Affected by this vulnerability is an unknown functionality of the file /Blog/BlogSearch.aspx of the component Login Endpoint. The manipulation of the argument Keyword results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in Tiobon Employee Self-Service System versions up to 7.2 allows authenticated remote attackers to manipulate the Keyword parameter in /Blog/BlogSearch.aspx, executing arbitrary SQL against the underlying database with low impact across confidentiality, integrity, and availability. Publicly available exploit code exists and has been disclosed via VulDB, while the vendor failed to respond to responsible disclosure, leaving no vendor-released patch at time of analysis. This is not confirmed as actively exploited (not in CISA KEV), but the low-complexity, network-reachable nature combined with a public proof-of-concept represents a credible opportunistic risk for organizations running this HR application.
Technical ContextAI
The vulnerable component is the blog search feature (/Blog/BlogSearch.aspx) within the Tiobon Employee Self-Service System, an HR-focused web application. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the Keyword parameter passed to a search query is not sanitized or parameterized - user-supplied input is interpolated directly into SQL statements, allowing an attacker to alter query logic. The CPE string cpe:2.3:a:tiobon:employee_self-service_system:*:*:*:*:*:*:*:* with a wildcard version field confirms the entire product line through version 7.2 is affected. The endpoint is described as part of a Login Endpoint context, suggesting the vulnerable search functionality is present in or adjacent to the authentication surface of the application - a notable detail that may affect exposure surface depending on whether the endpoint requires a valid session to reach.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure, and no official fix version is available. Organizations running Tiobon Employee Self-Service System ≤7.2 should implement compensating controls: deploy a web application firewall (WAF) with SQL injection detection rules targeting the Keyword parameter on requests to /Blog/BlogSearch.aspx, noting that sophisticated obfuscation techniques may evade signature-based WAF rules. Enforce strict network perimeter controls to limit access to the application to known trusted IP ranges, reducing opportunistic attack surface. Audit application access logs and database query logs for anomalous Keyword parameter patterns indicative of injection attempts. Consider disabling or restricting access to the /Blog/BlogSearch.aspx endpoint if blog search functionality is non-essential to operations - this eliminates the attack surface at the cost of that feature. If the vendor releases a patched version in the future, it should be applied immediately. Monitor https://vuldb.com/vuln/369073 for disclosure updates.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today