EUVD-2026-89438
GHSA-2qr9-7mqj-pwfj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network SQLi with low complexity but requires high-privilege authentication (PR:H); blind SQLi primarily extracts data (C:H) with limited integrity/availability (I:L/A:L) and no scope change.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
7DescriptionCVE.org
The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability.
AnalysisAI
Time-based blind SQL injection in the 'search' parameter of the view-audit-logs feature (utilities section) of Toptech Systems' TMS7 and TopHat terminal-automation platforms, confirmed affecting version 7.6.3, lets an attacker with an authenticated high-privilege session force the backend database to leak data through conditional response delays. Exploitation is access-gated rather than open: the independent assessment (CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L) aligns with the vendor's v4.0 vector (PR:H) in requiring a privileged, authenticated foothold, and the flaws sit in OT/terminal-management deployments that are normally segmented rather than internet-facing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with high privileges (PR:H) on the Toptech TMS7 or TopHat application, reachable over the network, then interaction with the 'search' input in the view-audit-logs feature located under the utilities section. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but access-gated risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: TMS7 v7.8, announced in Toptech's security blog post at https://www.toptech.com/blog/tms7-version-7-8-strengthens-security, which is the recommended primary fix for TMS7 7.6.3; operators running TopHat 7.6.3 should contact Toptech Systems to confirm the corresponding fixed build, since only TMS7 v7.8 is explicitly documented as the remediating release in the available references. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all TMS7 and TopHat deployments to identify instances at 7.6.3 or earlier, confirm they are not internet-facing, and restrict access to the utilities/view-audit-logs feature to the minimum set of privileged accounts; enable database and application logging on the search parameter to spot anomalous conditional-delay probing. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Toptech Systems TMS7 and TopHat expose a file export endpoint that lets any network-reachable, unauthenticated attacker
Arbitrary PHP file upload and execution is possible in Toptech Systems TMS7 and TopHat version 7.6.3, because the TMS fi
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat lets an authenticated, high-privilege operator inject
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat terminal management software lets an authenticated hig
Time-based blind SQL injection in the home-page search function of Toptech Systems' TMS7 terminal management application
Time-based blind SQL injection in the business allocation search feature of Toptech Systems TMS7 and TopHat 7.6.3 and ea
Session fixation (CWE-384) in Toptech Systems TMS7 and TopHat terminal management platforms allows an attacker to seed a
Cross-site scripting (CWE-79) in Toptech Systems' TMS7 terminal management platform (and the related TopHat product) all
Remote code execution in Tophat mobile testing harness prior to 2.5.1 allows authenticated network attackers to execute
Authenticated attackers positioned on the adjacent network can abuse unsafe inline-script and string-evaluation (eval-cl
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today