AI analysis
Toptech TMS7 and TopHAT are affected by a time-based blind SQL injection (CWE-89) in the supplier_no parameter of the business allocation search feature. A remote attacker who already has high-privileged access can trigger it over the network with low complexity and no user interaction by sending crafted input in that parameter. Successful exploitation can expose sensitive data and disrupt availability, with a more limited effect on integrity, and CVSS also rates follow-on systems as similarly exposed. Versions are not stated in the provided data. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Apply the vendor fix for Toptech TMS7 and TopHAT as soon as it is available from Toptech or the ICS-CERT advisory, and restrict the business-allocation search feature to only the high-privilege accounts that need it. Until patched, limit network access to the application, review logs for unusual or delayed queries on the supplier_no parameter, and treat high-privilege accounts as high value.
Affected
| Toptech TMS7 | — |
| Toptech TopHAT | — |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.