Construction Management System CVE-2026-6191

Exploitation requires prior authentication to the Construction Management System (PR:L in CVSS vector). An attacker must possess valid login credentials or exploit a separate authentication bypass to gain initial access. The vulnerability is triggered by direct manipulation of the Name parameter submitted to /equipments.php, typically through HTTP POST or GET requests. No additional special configuration or non-default settings appear necessary once authenticated access is obtained-the vulnerable input validation applies to the standard equipment management functionality.

Multiple risk signals present conflicting urgency indicators. The CVSS vector shows AV:N (network-accessible) and PR:L (requires login), with E:P indicating publicly available proof-of-concept code. However, the EPSS score of 0.03% places this in the 8th percentile-indicating very low empirical exploitation probability despite public POC availability. SSVC analysis suggests this is exploitable (network vector, low attack complexity) but with limited scope (L impact ratings for confidentiality, integrity, availability). The discrepancy between CVSS/POC availability and EPSS suggests the vulnerability requires authenticated access (PR:L) and affects a niche audience (specialized construction management software), reducing real-world attack surface. This is a moderate-priority issue for organizations running this specific application, but not a widespread threat.

An authenticated user with legitimate login credentials accesses the Construction Management System and navigates to the equipment management section. The attacker crafts a malicious SQL injection payload in the Name parameter (e.g., Name='; DROP TABLE users; --) and submits it through the /equipments.php endpoint. Due to insufficient input validation, the injected SQL executes within the database context, potentially allowing the attacker to read sensitive construction project data, modify equipment records, or compromise other database tables depending on database permissions.