Database disclosure via unsanitized login username

Blind HQL injection in the ServiceTonic Helpdesk login form before 9.0.35937 allows remote attackers to read database data through timing. The username value is concatenated without sanitization into an HQL lookup, and database functions such as sleep pass through to create a response-time oracle. No authentication or user interaction is required; the flaw discloses stored data, while the separately checked password prevents direct login bypass.