EUVD-2026-89471
GHSA-6c5h-cm4j-w42x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable low-complexity SQLi but requires high-privilege auth (PR:H); blind extraction gives C:H, limited write/DoS give I:L/A:L, no clear scope change so S:U.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
7DescriptionCVE.org
The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability.
AnalysisAI
Time-based blind SQL injection in the home-page search function of Toptech Systems' TMS7 terminal management application lets an attacker who already holds a high-privileged session inject SQL through the 'pattern' query parameter and infer database contents from response timing. The vendor addressed the flaw in TMS7 version 7.8, so unpatched pre-7.8 deployments are the exposed population; TOPHAT is also listed in the affected CPE set. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated high-privileged session on the TMS application (CVSS PR:H) to reach the home-page search feature; the attacker then injects into the 'pattern' search parameter, which is not properly parameterized. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a real but access-gated concern rather than an internet-scale emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: TMS7 version 7.8, which the vendor documents as a security-hardening release (https://www.toptech.com/blog/tms7-version-7-8-strengthens-security); upgrade all pre-7.8 TMS7 instances, and evaluate TOPHAT against the same advisory per CISA ICSA-26-272-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all TMS7 and TOPHAT deployments, identify any versions prior to 7.8, and restrict access to the home-page search function to only essential high-privileged users while monitoring for anomalous query timing or database inference attempts; note that no public exploit identified at time of analysis, but the vulnerability requires authenticated high-privileged access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Toptech Systems TMS7 and TopHat expose a file export endpoint that lets any network-reachable, unauthenticated attacker
Arbitrary PHP file upload and execution is possible in Toptech Systems TMS7 and TopHat version 7.6.3, because the TMS fi
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat lets an authenticated, high-privilege operator inject
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat terminal management software lets an authenticated hig
Time-based blind SQL injection in the 'search' parameter of the view-audit-logs feature (utilities section) of Toptech S
Time-based blind SQL injection in the business allocation search feature of Toptech Systems TMS7 and TopHat 7.6.3 and ea
Session fixation (CWE-384) in Toptech Systems TMS7 and TopHat terminal management platforms allows an attacker to seed a
Cross-site scripting (CWE-79) in Toptech Systems' TMS7 terminal management platform (and the related TopHat product) all
Remote code execution in Tophat mobile testing harness prior to 2.5.1 allows authenticated network attackers to execute
Authenticated attackers positioned on the adjacent network can abuse unsafe inline-script and string-evaluation (eval-cl
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today