TSG Profleet: SQL injection via index.php parameter
Summary
An SQL injection vulnerability (CWE-89) in TSG Profleet allows an attacker to retrieve, create, update and delete data in the database by sending a crafted GET request to the 'Identificación' parameter of '/cgi-bin/index.php'. No authentication is required according to the CVSS vector, so a reachable instance can be attacked without a login. The CVSS v4.0 base score of 9.3 is reported by CNA/INCIBE; VulDB lists 6.3.
Affected
- TSG Profleet version 12.004.01 according to INCIBE (a mirror lists 12.064.01; unverified)
- Full affected version range: Unknown.
Fixed in
- No fix available. No solution has been reported as yet.
Workaround
- No vendor workaround published.
- Interim measures: restrict access to the web interface to the management network or VPN, restrict source IPs, and use a web application firewall with SQL injection rules as a stopgap (VulDB generic guidance).
Exploitation
- INCIBE lists exploitation as 'No'; the vulnerability is tagged '0day'.
- No public proof of concept or in-the-wild exploitation found; CISA SSVC reports exploitation: none, automatable: yes.
- EPSS score 0.00228.
Our recommendation
- Check whether Profleet is installed and whether its web interface is reachable from the internet or from shared networks; remove internet exposure immediately.
- Restrict access to the management network or VPN and limit source IPs.
- Monitor web logs for unusual requests to /cgi-bin/index.php.
- Back up the database and ask TSG in writing for a patch date.
- Priority: high if exposed, medium if only on an isolated management network.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- INCIBE-CERT notice INCIBE-2026-754 www.incibe.es
- VulDB CVE-2026-111472 vuldb.com
- VulDB vulnerability 421248 vuldb.com
- Positive Technologies PT-2026-115537 (via Vulners) vulners.com
- EUVD-2026-102826 (via Vulners) vulners.com
- Strix CVE record www.strix.ai
- TSG ProFleet LOGmaster product page www.tsg-solutions.com
- TSG fuel management product page www.tsg-solutions.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:32.
Original description (NVD)
An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.