The vulnerability exists in Tiobon Employee Self-Service System through the /Blog/BlogSearch.aspx login endpoint. Manipulating the Keyword argument allows an attacker to inject arbitrary SQL statements into the backend database. This remote SQL injection could enable data theft, unauthorized modification, or denial of service by compromising the database integrity or confidentiality.

Tiobon Employee Self-Service System versions up to 7.2 are affected. No specific hotfix is referenced, and the vendor has not released a public patch for this issue.

The CVSS score of 5.3 indicates a moderate severity, but the vulnerability can be exploited remotely using publicly available exploit code. With no EPSS data and the vulnerability not listed in CISA's KEV catalog, the timing and frequency of exploitation remain uncertain. However, because the entry point is accessible over the network and the exploit is publicly known, the risk to systems with exposed bundles is significant and warrants immediate remediation.