Think Software Technology’s EFence has a High-severity SQL Injection flaw affecting versions 1.2.65 DB55 and earlier; upgrade to 1.2.67 DB57 or later.
An announcement from the Taiwan Vulnerability Disclosure Platform指出 that the Electronic Fence (EFence) developed by Think Software Technology contains a SQL Injection vulnerability, identified as TVN-202609006, corresponding to CVE-2026-89180, with a public disclosure date of 2026-09-14. The announcement also classifies this vulnerability as High risk.
The announcement states that an unauthenticated remote attacker can inject arbitrary SQL commands to read database contents.
The essence of SQL Injection is that an application directly concatenates or passes external input into SQL queries without effectively distinguishing between "data" and "commands." When a system lacks proper input validation, parameterized queries, or security controls, an attacker may manipulate query behavior through special characters, syntax structures, or conditional expressions, causing a process that should return normal data to instead execute unintended database operations.
Based on the announcement, the exploit conditions for this weakness are relatively permissive, because it can be triggered remotely without authentication. From the CVSS 4.0 vector, the combination of AV:N, AC:L, AT:N, PR:N, UI:N indicates that the attack can be performed over the network, with low prerequisites, no privileges, and no user interaction; VC:H indicates a high impact on confidentiality. The C:H value in the CVSS 3.1 vector also supports the same conclusion.
Affected products are Electronic Fence versions 1.2.65 DB55 and earlier, and the fixed version is 1.2.67 DB57 and later.
Because the vulnerability allows an unauthenticated remote attacker to read database contents, the actual impact usually depends on the type of information stored in the database.
The announcement shows two scoring versions: CVSS 8.7 and 7.5.
Update Electronic Fence to version 1.2.67 DB57 or later.