EUVD-2026-19168
GHSA-j8r9-fj5r-fm7x
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 6.3 score reflects moderate impact with confidentiality, integrity, and availability all partially compromised (C:L/I:L/A:L), combined with low attack complexity and network accessibility. However, the authentication requirement (PR:L) significantly reduces real-world risk compared to unauthenticated SQL injection variants. The EPSS score is not provided, but the E:P vector notation suggests proof-of-concept availability, which is confirmed by public GitHub disclosure. While the vulnerability is not listed in CISA KEV, the public exploit code availability and low attack complexity make this a practical risk for organizations actively running Construction Management System 1.0. The threat level is elevated for multi-user deployments where legitimate users could be compromised or malicious insiders could exploit this vector. This is a legitimate medium-priority vulnerability requiring prompt attention, not a theoretical high-CVSS-low-risk issue, given authenticated attack surface and public exploit availability. |
| Exploit ScenarioDerived | An authenticated user with access to the Construction Management System discovers or uses publicly available exploit code from GitHub to inject malicious SQL into the Home parameter of /borrowed_equip_report.php. By crafting a request such as /borrowed_equip_report.php?Home=value' OR '1'='1, the attacker executes arbitrary SQL queries against the backend database, potentially exfiltrating sensitive construction project data, employee information, or equipment inventory records. The attack requires only network connectivity and valid login credentials, making it a practical risk in organizations where employee accounts may be compromised or where malicious insiders have system access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 06, 2026
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Home parameter in /borrowed_equip_report.php, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, and demonstrates low attack complexity with network-based delivery requiring valid credentials.
RemediationAI
Update to a patched version of itsourcecode Construction Management System if available from the vendor website https://itsourcecode.com/. No specific patch version number is independently confirmed from available vendor advisory data. As an interim mitigation, restrict access to the /borrowed_equip_report.php endpoint using network-level access controls, implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the Home parameter, and review and restrict user account privileges to the minimum necessary level. Implement parameterized queries and input validation for all user-supplied parameters in report generation functionality. Verify any available security updates from the vendor and apply promptly when released.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in a PHP-based parameter handler within the Construction Management System's report generation module. The /borrowed_equip_report.php file fails to properly sanitize or parameterize the Home parameter before incorporating it into SQL queries, creating a classic SQL injection point (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). The CPE cpe:2.3:a:itsourcecode:construction_management_system:*:*:*:*:*:*:*:* indicates the vulnerability affects the Construction Management System product family. Since the CVSS vector shows PR:L (requires Low privilege level), the attack requires an authenticated user session, limiting the immediate threat surface but still representing a significant privilege escalation or lateral movement vector within an organization using this application.
Know when Construction Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in itsourcecode Construction Management System 1.0. Affected is an unknown function of the file /borrowed_equip_report.php of the component Parameter Handler. The manipulation of the argument Home leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
SQL injection in itsourcecode Construction Management System 1.0 allows remote unauthenticated attackers to manipulate t
SQL injection in itsourcecode Construction Management System 1.0 allows remote unauthenticated attackers to manipulate t
SQL injection in itsourcecode Construction Management System 1.0 via the code parameter in /execute.php allows remote un
A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attacker
A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers to
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to manipulate the
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
Exploit-DB