CVE-2026-18198: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') in TAC Information Services Internal and External Trade Inc. GOLDENHORN ONEIT

This vulnerability, identified as CVE-2026-18198 and classified under CWE-89, involves improper neutralization of special elements used in SQL commands within the GOLDENHORN ONEIT product by TAC Information Services Internal and External Trade Inc. The issue permits blind SQL injection attacks, potentially allowing an attacker with low privileges to execute arbitrary SQL commands remotely without user interaction. The CVSS v3.1 score is 8.8, indicating high impact on confidentiality, integrity, and availability. The affected versions are those prior to the Göbeklitepe release, though exact version numbers are not specified. No patch or official remediation level has been provided by the vendor as of the publication date.

Successful exploitation can lead to full compromise of the database confidentiality, integrity, and availability. Attackers could extract sensitive data, modify or delete database contents, or disrupt service. The vulnerability requires network access with low privileges and no user interaction, making it a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider implementing application-level input validation and use of parameterized queries or prepared statements to mitigate SQL injection risks. Monitoring for unusual database queries may help detect exploitation attempts.