TMS7 vulnerabilities
5 known vulnerabilities in TMS7 from Toptech Systems. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.0 Critical severity
TMS7: Improper Neutralization of Special Elements used in an SQL Command
The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulnerability.
- 7.1 High severity
TMS7: Session Fixation
The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover.
- 9.1 Critical severity
TMS7: Unrestricted Upload of File with Dangerous Type
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.
- 9.0 Critical severity
TMS7: Improper Neutralization of Special Elements used in an SQL Command
The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability.
- 9.0 Critical severity
TMS7: Improper Neutralization of Special Elements used in an SQL Command
The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability.