The 'pattern' parameter in the TMS home page search function is vulnerable to a time‑based blind SQL injection, allowing an attacker to extract database information by measuring response delays. This leads to significant confidentiality risks and aligns with CWE‑89, which denotes SQL injection weaknesses.

The flaw affects Toptech Systems products TMS7 and TopHAT, and versions prior to release 7.8 are vulnerable. The vendor’s advisory indicates that update 7.8 mitigates the issue.

The CVSS score of 8.5 classifies the vulnerability as high severity. EPSS data is lacking and the flaw is not listed in CISA KEV, suggesting no known active exploitation. However, the attack can be carried out remotely without authentication or privileged access, making the exploit path straightforward and posing a significant risk of confidential data exposure.