External risk intelligence

TSG Profleet SQL Injection Leads to Database Compromise

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-111472

The vulnerability exists in a web application endpoint (/cgi-bin/index.php) accessible via GET requests. Such applications are commonly deployed as internet-facing web services, making the identified endpoint a likely target for remote interaction over the public internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical SQL injection vulnerability has been found in TSG Profleet, which could allow unauthorized access and modification of sensitive data. The issue stems from how the software handles specific data inputs, potentially enabling attackers to manipulate database contents through a web interface. The primary concern is to determine if this technology is in use and exposed.

Database data can be accessed and altered.
Understand if this software is in use.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted GET request to the `/cgi-bin/index.php` endpoint. This request would leverage the `Identificación` parameter to inject malicious SQL commands, potentially allowing unauthorized access and manipulation of the system's database.

No authentication or special access needed.
Triggered by a GET request with a malicious parameter.
Risks unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

This SQL injection vulnerability could allow an attacker to modify, create, or delete data within the TSG Profleet database. The vulnerability is present in the ‘/cgi-bin/index.php’ endpoint and can be triggered by sending a GET request with a specially crafted ‘Identificación’ parameter.

Database data integrity.
Via crafted GET requests.
Unauthorized data modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for managing web applications and their underlying infrastructure, such as application owners, platform teams, and network/security teams, should prioritize addressing this SQL injection vulnerability. The first practical step is to identify all instances of TSG Profleet within your environment, determine their network accessibility and business criticality, and then confirm the accountable owner for each instance to plan a risk-based remediation strategy.

Application and infrastructure teams own resolution.
Verify public-facing, critical instances first.
Plan remediation based on verified exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is TSG Profleet?

TSG Profleet is a software solution used for managing fleet operations, which typically involves tracking vehicle data, fuel management, or logistics reporting. It functions as a web-based application, meaning it relies on a server-side component to process information and interact with a database to store and retrieve records necessary for fleet administration.

What does SQL injection mean for CVE-2026-111472?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In plain terms, the software fails to properly sanitize user input, allowing an attacker to inject their own database commands. Because of this flaw, the application mistakenly executes these malicious instructions, granting the attacker the ability to view, modify, or delete sensitive data stored in the database.

How is this SQL injection triggered?

The flaw is triggered when an attacker sends a specifically crafted GET request to the ‘/cgi-bin/index.php’ endpoint. By embedding malicious SQL syntax into the ‘Identificación’ parameter, the attacker forces the database to process unauthorized commands. Note that standard or benign usage of this parameter does not trigger the bug; it specifically requires the input to contain intentionally harmful code designed to manipulate the database.

Is my TSG Profleet instance at risk?

Halo Surface Signal indicates that because the affected endpoint is accessible via standard web requests, it is frequently deployed in internet-facing configurations. If your instance is reachable from the public internet, it is a likely target for remote interaction. You should evaluate whether your deployment is exposed to external networks or if it is restricted to internal use, as this significantly impacts the immediate risk level.

What should I do if I use TSG Profleet?

Begin by auditing your environment to locate all running instances of the software. Once you have an inventory, assess the network placement of each instance, prioritizing those that are publicly accessible. Identify the teams responsible for these systems to establish a clear plan for applying updates or implementing security controls to block malicious requests directed at the vulnerable endpoint.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.