The vulnerability exists in the 'pattern' parameter used in the search function on the home page of the TMS7 application by Toptech Systems. It is a time-based blind SQL injection flaw (CWE-89) that can be exploited remotely over the network with low attack complexity and no user interaction required. The CVSS 3.1 base score is 9.0, indicating critical severity, with attack vector network, low attack complexity, high privileges required, no user interaction, scope changed, and impacts of high confidentiality, low integrity, and high availability.

Successful exploitation can lead to unauthorized disclosure of sensitive information (high confidentiality impact), partial modification of data (low integrity impact), and disruption of service (high availability impact). The attack requires high privileges but can be performed remotely without user interaction, making it a serious threat to affected systems.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected functionality to trusted users only and monitor for suspicious activity related to SQL injection attempts.