EUVD-2026-89428
GHSA-9cvv-p66c-32h8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable low-complexity blind SQLi but requires high-privilege auth (PR:H); primary impact is data extraction (C:H), with minor integrity/availability (blind time-delay), no scope change.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
7DescriptionCVE.org
The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection.
AnalysisAI
Time-based blind SQL injection in the business allocation search feature of Toptech Systems TMS7 and TopHat 7.6.3 and earlier lets a high-privilege authenticated attacker inject SQL through the supplier_no parameter and infer database contents by measuring conditional query delays. The vendor fixed the issue in TMS7 v7.8, documented in CISA ICS advisory ICSA-26-272-02 and tracked as EUVD-2026-89428, and no public exploit code or confirmed active exploitation was identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires high-privilege authenticated access to the TMS7/TopHat web application (PR:H) and reachability of the business allocation search feature. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but access-gated issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to TMS7 v7.8, the vendor release identified by the Toptech security blog (https://www.toptech.com/blog/tms7-version-7-8-strengthens-security) and CISA ICS advisory ICSA-26-272-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02) as containing the fix, and confirm the corresponding TopHat build with Toptech since the advisory covers both CPEs; if a tagged TopHat fix version is not published, treat the TMS7 v7.8 guidance as applicable and verify with the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which instances of Toptech Systems TMS7 and TopHat (7.6.3 and earlier) are deployed, whether the business allocation search endpoint is externally reachable or vendor/partner-accessible, and inventory every privileged account that can call it. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Toptech Systems TMS7 and TopHat expose a file export endpoint that lets any network-reachable, unauthenticated attacker
Arbitrary PHP file upload and execution is possible in Toptech Systems TMS7 and TopHat version 7.6.3, because the TMS fi
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat lets an authenticated, high-privilege operator inject
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat terminal management software lets an authenticated hig
Time-based blind SQL injection in the home-page search function of Toptech Systems' TMS7 terminal management application
Time-based blind SQL injection in the 'search' parameter of the view-audit-logs feature (utilities section) of Toptech S
Session fixation (CWE-384) in Toptech Systems TMS7 and TopHat terminal management platforms allows an attacker to seed a
Cross-site scripting (CWE-79) in Toptech Systems' TMS7 terminal management platform (and the related TopHat product) all
Remote code execution in Tophat mobile testing harness prior to 2.5.1 allows authenticated network attackers to execute
Authenticated attackers positioned on the adjacent network can abuse unsafe inline-script and string-evaluation (eval-cl
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today