This vulnerability in Tiobon Employee Self-Service System up to version 7.2 involves an SQL injection flaw in the /Blog/BlogSearch.aspx file of the Login Endpoint component. Remote attackers can exploit the manipulation of the 'Keyword' parameter to inject SQL commands. The vulnerability has been publicly disclosed, but the vendor has not provided any response or patch. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database via the vulnerable 'Keyword' parameter. This may lead to unauthorized data access or modification. However, the impact is rated medium due to limited complexity and partial impact on confidentiality, integrity, and availability as per the CVSS vector.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded to the disclosure, users should consider implementing application-level mitigations such as input validation and parameterized queries if possible. Monitor vendor channels for any future updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.