TSG Profleet SQL Injection Risks Data Loss for Fleet Managers
A critical flaw in TSG Profleet allows attackers to manipulate database records via a specific web parameter.
Key points
- CVE-2026-111472 is rated critical with a CVSS score of 9.3.
- The vulnerability affects TSG Profleet versions released before October 16, 2026.
- Attackers can retrieve, create, update, or delete data using a crafted GET request.
TSG Profleet versions released before October 16, 2026, contain a critical SQL injection flaw. The National Vulnerability Database lists CVE-2026-111472 with a CVSS score of 9.3. This weakness allows remote attackers to manipulate the underlying database. The issue stems from improper handling of user input in a specific web endpoint.
How it unfolded
- The vulnerability was identified in TSG Profleet software prior to the October 16, 2026 release.
- Researchers determined that the ‘Identificación’ parameter in the ‘/cgi-bin/index.php’ endpoint is vulnerable.
- The flaw was classified under CWE-89, indicating a failure to neutralize special elements in SQL commands.
Who is affected
Organizations using TSG Profleet fleet management software are at risk if they have not updated to the version released on or after October 16, 2026. The vulnerability is located in the ‘/cgi-bin/index.php’ endpoint. Any system exposing this endpoint is potentially vulnerable. Attackers can send a GET request using the ‘Identificación’ parameter to exploit the flaw.
Our take on the response
The high severity rating reflects the potential for complete data compromise. SQL injection flaws of this nature often allow full database control. The specific date cutoff suggests a version was released on October 16, 2026. Teams must verify their current version immediately. Delaying updates leaves sensitive fleet data exposed to unauthorized modification or deletion.
Who needs to act first
Managed service providers should prioritize systems with direct internet exposure. Check which client environments run TSG Profleet versions older than the October 2026 update. Isolate vulnerable instances from public networks while testing the patch. Verify that the update resolves the specific endpoint issue before rolling it out broadly. Ensure database backups are current before applying changes. Monitor logs for unusual GET requests targeting the index page.
Background: SQL injection
Prevent SQL injection by using parameterized queries that treat user input as data, not executable code. Combine this with strict input validation and least-privilege database accounts. This layered approach stops attackers from altering your database logic or extracting sensitive information through crafted input strings.
Read the full guide: How to Prevent SQL Injection Attack: 3 Layers of Defense
What to do and how to stay safe: TSG Profleet
- Audit all TSG Profleet installations to confirm the version number against the October 16, 2026 cutoff.
- Restrict network access to the ‘/cgi-bin/index.php’ endpoint to trusted IP addresses only.
- Monitor web server logs for suspicious activity involving the ‘Identificación’ parameter.
- Apply the vendor update as soon as it is available for your specific deployment environment.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-111472?
The CVSS score is 9.3, which is classified as critical severity.
Which TSG Profleet versions are vulnerable?
Versions released before October 16, 2026, are affected by this SQL injection flaw.
How can an attacker exploit this vulnerability?
Attackers can send a GET request using the ‘Identificación’ parameter on the ‘/cgi-bin/index.php’ endpoint.
