EUVD-2026-71082
GHSA-mccf-v8pf-76jg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible blind SQLi requiring only a low-privilege account; full database read/write/delete impact confirms C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (TR-CERT).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TAC Information Services Internal and External Trade Inc. GOLDENHORN ONEIT allows Blind SQL Injection.
This issue affects GOLDENHORN ONEIT: before Göbeklitepe.
AnalysisAI
Blind SQL injection in GOLDENHORN ONEIT, an enterprise trade management platform by TAC Information Services Internal and External Trade Inc., allows low-privileged authenticated attackers to enumerate and extract the full database contents. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N) reflects network-accessible exploitation requiring only a valid low-privilege account, with full confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | A valid low-privileged user account on the GOLDENHORN ONEIT application is required (CVSS PR:L); unauthenticated exploitation is not supported by the available vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 rating reflects a genuine high-severity vulnerability: network-accessible, low-complexity, requiring only low-privilege credentials, with full C:H/I:H/A:H impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade GOLDENHORN ONEIT to the 'Göbeklitepe' release or later, which addresses this blind SQL injection. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all GOLDENHORN ONEIT deployments in your environment, review database access logs for SQL injection patterns, and disable unnecessary low-privilege user accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today