EUVD-2026-19239Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS score of 5.3 appears moderate, the risk profile is constrained by several factors. The attack vector is network-accessible (AV:N) and requires no user interaction (UI:N), but mandatory authentication (PR:L) substantially narrows the threat actor pool to users with legitimate system access. The CVSS 4.0 vector reflects low confidentiality (VC:L), integrity (VI:L), and availability (VA:L) impact, with no scope escalation (S:X indicates no scope change). The E:P tag confirms public exploit availability, increasing accessibility but not necessarily real-world exploitation velocity. From an SSVC perspective, this presents a low-to-medium priority: exploitation is publicly available and technically feasible, but the requirement for authentication and limited impact reduce operational severity compared to unauthenticated remote code execution vulnerabilities. Organizations should prioritize patching based on authentication model-if the system has many internal users or weak access controls, risk elevation is warranted. |
| Exploit ScenarioDerived | A user with valid system credentials could craft a malicious SQL payload in the emp parameter when accessing /borrowed_equip.php, such as emp=1' OR '1'='1, to execute arbitrary SQL commands against the underlying database. Public exploit code is available on GitHub (https://github.com/Learner636/CVE-smbmit/issues/4), lowering the barrier to exploitation for threat actors with system access. This could allow unauthorized data extraction or modification of equipment records and related business data, though privilege escalation or full system compromise is not achieved through this vector alone. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 06, 2026
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the emp parameter in /borrowed_equip.php, potentially compromising data confidentiality and integrity. The vulnerability has a CVSS score of 5.3 with publicly available exploit code; however, exploitation requires valid authentication credentials and does not grant administrative privileges or enable denial of service.
RemediationAI
Apply the latest security patch from itsourcecode available at https://itsourcecode.com/ or contact the vendor for version-specific patch guidance, as exact patched versions are not specified in available disclosure data. In the interim, implement input validation and prepared statements (parameterized queries) for the emp parameter in /borrowed_equip.php to neutralize SQL injection vectors. Restrict network access to the Construction Management System to trusted internal networks and implement strong authentication mechanisms to reduce the pool of users who can trigger the vulnerability. Monitor database query logs for suspicious SQL patterns as a detective control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from improper input validation in the Parameter Handler component of a PHP-based Construction Management System. The /borrowed_equip.php file fails to sanitize or parameterize the emp parameter before incorporating it into SQL queries, enabling SQL injection attacks classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The affected product is identified by CPE cpe:2.3:a:itsourcecode:construction_management_system, indicating all versions of itsourcecode's Construction Management System are potentially vulnerable. The exploitation vector is network-based with low attack complexity, but requires prior authentication (PR:L per CVSS 4.0 vector).
Know when Construction Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /borrowed_equip.php of the component Parameter Handler. This manipulation of the argument emp causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
SQL injection in itsourcecode Construction Management System 1.0 allows remote unauthenticated attackers to manipulate t
SQL injection in itsourcecode Construction Management System 1.0 allows remote unauthenticated attackers to manipulate t
SQL injection in itsourcecode Construction Management System 1.0 via the code parameter in /execute.php allows remote un
A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attacker
A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers to
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to manipulate the
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
Exploit-DB