Critical SQL Injection Flaw Found in TSG Profleet Fleet Management Software

A critical SQL injection vulnerability has been identified in TSG Profleet, a fleet management software product. The National Vulnerability Database (NVD) assigned the flaw the identifier CVE-2026-111472 and rated it with a CVSS score of 9.3. This high-severity rating indicates that the defect could allow unauthorized users to compromise the integrity and confidentiality of the application’s underlying database.

The vulnerability is classified under CWE-89, which describes SQL injection weaknesses. According to the NVD record, an attacker could retrieve, create, update, and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint. The source material does not specify the exact code-level cause beyond the classification of SQL injection.

Context and Background

SQL injection vulnerabilities allow attackers to interact directly with the database engine through web applications. In this specific case involving TSG Profleet, the consequences of exploitation are severe. The NVD description states that an attacker could retrieve, create, update, and delete data from the database. This level of access means that sensitive fleet information could be exfiltrated or altered.

The mechanism for exploitation involves standard HTTP GET requests. The use of the ‘Identificación’ parameter is the specific vector identified in the NVD record. The source material does not provide further details on the complexity of the attack or the specific nature of the parameter beyond its name and location in the URL structure.

Who Is Affected

The vulnerability affects versions of TSG Profleet that were released before October 16, 2026. Any organization using the software prior to this date is potentially exposed to unauthorized database manipulation. Fleet management systems often contain sensitive data regarding vehicle locations and driver information, making them attractive targets for cybercriminals.

There is no indication in the source material that a patch or update has been released to address CVE-2026-111472. Users of affected versions should assume their systems are vulnerable until the vendor provides a confirmed fix. The NVD record does not specify which subsequent version resolves the issue, only that versions before the specified date are at risk.

What should you do?

Organizations using TSG Profleet should immediately verify their current version against the cutoff date of October 16, 2026. If the software version predates this release, administrators should treat the system as vulnerable. Network segmentation and strict access controls can help limit the potential damage while waiting for a vendor response.