An SQL injection flaw exists in TSG Profleet's /cgi-bin/index.php endpoint, triggered by a GET request that uses the ‘Identificación’ parameter. The vulnerability allows an attacker to read, write, and delete database records, compromising confidentiality and integrity of stored data. This weakness is identified as CWE‑89: SQL Injection. No evidence of remote code execution is present, but the ability to alter data can enable further malicious activities.

The affected product is TSG Profleet. No specific version information is disclosed, so all installations of this product may be vulnerable.

The CVSS score of 9.3 marks this as a high severity vulnerability. With no EPSS value available and the vulnerability not listed in CISA’s KEV catalog, the risk of exploitation is unknown but potentially significant. The flaw can be exploited remotely by sending a crafted GET request to the identified endpoint, requiring no special privileges or internal access.