EUVD-2026-22018
GHSA-x9rc-hqj2-wh76
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege system credentials
-
DeliverySubmit SQL injection payload in Name parameter
-
ExploitUnsanitized input reaches database query
-
ExecutionExecute unintended SQL commands
-
ImpactExfiltrate or modify sensitive project and employee data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS score of 6.3 is moderate, several risk signals elevate practical concern. The attack vector is network-based and requires only low-privilege authentication (PR:L), lowering the barrier to exploitation compared to unauthenticated attacks. The attack complexity is low (AC:L), and the scope is unchanged (S:U), limiting impact to the application's own database. However, the availability of public exploit code (POC:YES) combined with a real-world use case (construction management systems often handle sensitive project and employee data) suggests attackers have concrete tools to exploit this flaw. The E:P evidence level and R:X remediation level indicate public proof-of-concept but unclear vendor patch status, creating operational risk for organizations using this product. This is a genuine operational priority rather than a theoretical high-CVSS issue, particularly for businesses relying on this software for day-to-day operations. |
| Exploit ScenarioDerived | An employee with valid system credentials (low-privilege user account) accesses the construction management system and navigates to the employee management interface. They craft a malicious SQL injection payload in the Name field, such as 'John' OR '1'='1'; DROP TABLE employees;--', and submit it through the /employees.php endpoint. The unsanitized input reaches the database layer, where the injected SQL executes alongside the original query, allowing the attacker to extract sensitive employee data, modify project records, or degrade data integrity across the system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 13, 2026
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Name parameter in /employees.php, resulting in confidentiality, integrity, and authenticity breaches. The vulnerability requires low-privilege authentication and has publicly available exploit code, elevating practical risk despite the moderate CVSS score of 6.3.
RemediationAI
Organizations using itsourcecode Construction Management System should immediately contact the vendor at https://itsourcecode.com/ to obtain a patched version; no specific patched release version is currently confirmed in available data. As an interim measure, restrict network access to /employees.php to authorized administrators only, enforce strong database access controls, and implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the Name parameter (e.g., detection of SQL keywords, quote escaping, comment syntax). Database activity monitoring should be enabled to detect anomalous query patterns. Code review and remediation should prioritize conversion to parameterized SQL queries or prepared statements in the affected endpoint.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic SQL injection (CWE-89) flaw in a PHP-based construction management application. The /employees.php endpoint fails to properly sanitize or parameterize the Name parameter before incorporating it into SQL queries. The CPE indicates all versions of itsourcecode Construction Management System are affected. This is a common pattern in older PHP applications that do not use prepared statements or ORM frameworks, allowing an authenticated attacker to craft malicious SQL syntax that executes unintended database operations beyond the application's intended logic.
Know when Construction Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /employees.php. Performing a manipulation of the argument Name results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
SQL injection in itsourcecode Construction Management System 1.0 allows remote unauthenticated attackers to manipulate t
SQL injection in itsourcecode Construction Management System 1.0 allows remote unauthenticated attackers to manipulate t
SQL injection in itsourcecode Construction Management System 1.0 via the code parameter in /execute.php allows remote un
A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attacker
A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers to
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to manipulate the
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
Exploit-DB