The vulnerability allows an attacker to inject arbitrary SQL through the supplier_no parameter in the business allocation search feature, enabling a time‑based blind SQL injection. This flaw can lead to extraction of sensitive database contents, potentially exposing confidential information and facilitating further compromise.

The flaw affects Toptech Systems TMS7 and TopHAT installations deployed prior to release 7.8; the advisory notes that the issue is resolved in version 7.8 while no specific earlier versions are listed.

The CVSS score of 8.5 signals high severity, though the EPSS score is not available so the current exploitation probability is unknown. The vulnerability is not recorded in CISA’s KEV catalog, so no active exploits have been reported yet. Attackers can reach the vulnerable endpoint remotely through normal web requests, inferring the injection success by observing timing differences in responses. No special privileges are required beyond the ability to submit queries to the business allocation search feature.