This vulnerability in Tiobon Employee Self-Service System (versions 7.0 to 7.2) involves SQL injection via the 'Keyword' parameter in the /Blog/BlogSearch.aspx file of the Login Endpoint component. The flaw allows remote attackers to manipulate SQL queries by injecting malicious input, potentially compromising database integrity or confidentiality. The vendor has not provided any remediation or acknowledgment, and no official patch or workaround is currently documented.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The CVSS 4.0 base score of 5.3 indicates a medium severity with network attack vector, low complexity, no user interaction, and limited scope and impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing input validation or web application firewall (WAF) rules to mitigate SQL injection risks in the affected parameter. Monitor for any updates from the vendor regarding patches or official mitigations.