TSG Profleet SQL Injection in Index Endpoint Risks Database Manipulation
A critical SQL injection flaw in TSG Profleet allows attackers to manipulate database records via a specific CGI parameter before a defined date.
Key points
- CVE-2026-111472 is rated critical with a CVSS score of 9.3.
- The flaw resides in the 'Identificación' parameter of the /cgi-bin/index.php endpoint.
- Attackers can retrieve, create, update or delete data using a standard GET request.
TSG Profleet fleet management software contains a critical SQL injection vulnerability that exposes connected databases to direct manipulation. Security researchers identified the flaw in the application’s web interface, specifically within the handling of user-supplied input. This issue affects versions released before 16 October 2026, leaving many installations vulnerable to data theft and modification.
Root cause
The vulnerability stems from insufficient sanitisation of the 'Identificación' parameter. When this parameter is passed to the /cgi-bin/index.php endpoint, the application incorporates the input directly into database queries. This lack of validation allows an attacker to inject malicious SQL commands. The weakness is classified under CWE-89, indicating a failure to neutralise special elements used in SQL commands.
Attack path
An adversary can exploit this flaw by sending a crafted HTTP GET request. By manipulating the 'Identificación' parameter, the attacker executes arbitrary SQL statements against the backend database. This access permits the retrieval of sensitive records, the creation of new entries, the updating of existing data or the deletion of critical information. The simplicity of the GET method makes automated scanning and exploitation straightforward.
Affected versions
- TSG Profleet versions prior to 16 October 2026 are affected.
- The advisory defines the affected range as software before this date.
- Users running builds older than this date are exposed to the risk.
Mitigation
- Update TSG Profleet to a version released on or after 16 October 2026.
- Restrict network access to the /cgi-bin/index.php endpoint from untrusted sources.
- Implement web application firewall rules to block SQL injection patterns.
- Monitor database logs for unexpected command execution or data changes.
Signals worth monitoring
Security teams should inspect web server logs for anomalous GET requests targeting the index.php endpoint, particularly those containing encoded SQL keywords. Database audit trails often reveal queries that deviate from standard application patterns, such as unexpected joins or union statements. Intrusion detection systems may flag payloads attempting to bypass authentication or extract schema information. Initial containment typically involves blocking the specific source IP address and isolating the affected web server from the database network to prevent lateral movement.
What to do and how to stay safe: TSG Profleet
- Verify your current TSG Profleet build date against the 16 October 2026 threshold.
- Review access logs for the 'Identificación' parameter for signs of exploitation attempts.
- Apply virtual patching via WAF if an immediate software update is not feasible.
- Ensure database accounts used by the application have minimal necessary privileges.
Step-by-step guide: Out-of-band patches: what small businesses need to know
General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-111472?
The vulnerability has a CVSS score of 9.3, which is rated as critical.
Which parameter is vulnerable to SQL injection?
The 'Identificación' parameter within the /cgi-bin/index.php endpoint is affected.
What actions can an attacker perform?
An attacker can retrieve, create, update and delete data from the database.
