itsourcecode Construction Management System CVE-2026-7074

Remote unauthenticated exploitation against /execute1.php with user-supplied code parameter. No special configuration, authentication, or user interaction is required. The vulnerability affects instances running itsourcecode Construction Management System version 1.0 with the /execute1.php endpoint accessible over the network. Exploitation is limited only by network reachability to the vulnerable endpoint and any network-layer firewall rules; the application accepts untrusted input by design.

CVSS 6.9 with AV:N/AC:L/PR:N/UI:N indicates network-accessible, unauthenticated exploitation with low complexity - a favorable attack surface. The CVSS vector shows confidentiality, integrity, and availability impact all set to Low (VC:L/VI:L/VA:L), which does not align with typical SQL injection severity; CVSS 4.0 calculations for SQLi typically yield higher impact scores, suggesting possible constraint by the base CVSS model. However, the exploitation probability marked as 'P' (Proof of Concept exists) and public availability of exploit code elevate practical risk significantly. The absence of KEV status, EPSS score, and vendor patch information creates assessment gaps, but the combination of network vector, no authentication requirement, public exploit availability, and straightforward SQLi execution pathway makes this a priority vulnerability for any organization running affected versions. The real-world risk is likely higher than the CVSS score suggests due to exploit accessibility and low attack complexity.

An attacker sends a crafted HTTP GET or POST request to /execute1.php with a malicious SQL payload in the code parameter (e.g., code=' OR '1'='1). The application concatenates this unsanitized input directly into a SQL query without validation, causing the query logic to execute unintended database operations. The attacker can extract sensitive data from the construction management database, modify project records, or potentially escalate to remote code execution if the database user has FILE privileges.