AI analysis
The home-page search function in the Toptech TMS application uses a pattern parameter that is vulnerable to time-based blind SQL injection (CWE-89). An attacker who already has high-privilege access can send a crafted pattern value over the network, with no user interaction, and infer database contents from differences in response timing. Successful exploitation can disclose sensitive data, allow limited modification, and degrade availability of the vulnerable system and subsequent systems. The issue is associated with Toptech TMS7 and TopHAT; affected version ranges are not stated in the advisory data. It is not in the CISA Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Apply the vendor security update for Toptech TMS7 and TopHAT as soon as it is published, and until then limit network access to the TMS web interface to trusted operators. Review application and database logs for unusual delays or malformed values submitted in the home-page search pattern parameter, and do not expose the interface directly to the internet.
Affected
| Toptech TMS7 | — |
| Toptech TopHAT | — |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.