EUVD-2026-89473
GHSA-6pvc-w8hw-cm6m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable low-complexity injection but requires privileged authentication (PR:H); blind SQLi yields high confidentiality read, limited integrity/availability, no cross-component scope change (S:U).
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
7DescriptionCVE.org
The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulnerability.
AnalysisAI
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat lets an authenticated, high-privilege operator inject SQL through the 'reportType' parameter of the product summary report in the balancing reports section, with data recovered indirectly by measuring database response delays rather than returned in the response. The issue is remotely reachable with no user interaction but is gated behind a privileged session (vendor CVSS:4.0 base 8.5; independent assessment CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L), so confidentiality is the primary exposure while integrity and availability impacts remain limited. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated session with HIGH privileges (PR:H) in the Toptech Systems TMS7/TopHat application and access to the product summary report within the balancing reports section; the attacker injects into the 'reportType' parameter. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but access-gated data-confidentiality issue rather than an internet-wide emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: TMS7 v7.8, documented at https://www.toptech.com/blog/tms7-version-7-8-strengthens-security, is the primary fix; coordinate the upgrade with CISA ICS advisory ICSA-26-272-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02) and apply it to both TMS7 and any TopHat components in the same environment, verifying that the patched balancing-reports module is actually in use after the upgrade. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every TMS7 and TopHat instance across terminal sites, confirm which are reachable from vendor or corporate networks, and review which accounts currently hold the high-privilege operator role required to reach the balancing reports; remove or downgrade any privileged operator account that is not strictly required for daily balancing work, and confirm no public exploit code is circulating against the reportType parameter. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Toptech Systems TMS7 and TopHat expose a file export endpoint that lets any network-reachable, unauthenticated attacker
Arbitrary PHP file upload and execution is possible in Toptech Systems TMS7 and TopHat version 7.6.3, because the TMS fi
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat terminal management software lets an authenticated hig
Time-based blind SQL injection in the home-page search function of Toptech Systems' TMS7 terminal management application
Time-based blind SQL injection in the 'search' parameter of the view-audit-logs feature (utilities section) of Toptech S
Time-based blind SQL injection in the business allocation search feature of Toptech Systems TMS7 and TopHat 7.6.3 and ea
Session fixation (CWE-384) in Toptech Systems TMS7 and TopHat terminal management platforms allows an attacker to seed a
Cross-site scripting (CWE-79) in Toptech Systems' TMS7 terminal management platform (and the related TopHat product) all
Remote code execution in Tophat mobile testing harness prior to 2.5.1 allows authenticated network attackers to execute
Authenticated attackers positioned on the adjacent network can abuse unsafe inline-script and string-evaluation (eval-cl
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today