itsourcecode Construction Management System CVE-2026-7075

The vulnerability requires the /locations.php file to be accessible and processing the address parameter without input sanitization or parameterized queries. No authentication is required (CVSS PR:N), and the application must accept and process the address parameter in an SQL query context. Exploitation is not limited to specific configurations or deployment modes - the default installation with standard PHP-to-database connectivity is sufficient. The attack is constrained only by the database user's privileges; if the application database account has limited permissions (read-only, restricted to specific tables), the attacker's ability to modify or exfiltrate data is accordingly limited.

The CVSS score of 6.9 with AV:N/AC:L/PR:N/UI:N indicates a network-accessible vulnerability requiring no authentication or user interaction, placing it in the 'medium' severity band under CVSS 4.0 standards. However, multiple risk signals elevate real-world concern: publicly available exploit code exists (E:P flag set), the attack is straightforward to execute against default configurations, and SQL injection provides direct database access. The limited scope (S:X/SC:N) and moderate impact values (VC:L/VI:L/VA:L) suggest the vulnerability does not propagate beyond the affected resource, and impact may be constrained by database permissions. The real risk depends heavily on deployment: if the application runs with administrative database privileges and exposes sensitive user or project data, this becomes critical for construction firms managing confidential bids and contracts. The publicly available exploit combined with unauthenticated network access creates a high-priority patching scenario despite the moderate CVSS number.

An attacker sends a crafted HTTP request to /locations.php with a malicious SQL injection payload in the address parameter, such as address='; DROP TABLE users; --. Because the application concatenates this directly into a SQL query without sanitization, the injected SQL executes with the database connection's privileges, allowing the attacker to extract sensitive construction project data, user credentials, or modify database contents. The publicly available exploit code reduces the barrier to execution, enabling non-skilled attackers to perform this attack.