EUVD-2026-21326Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 6.3 score reflects a moderate-to-high risk profile with network-accessible attack surface (AV:N), low attack complexity (AC:L), and low privileges required (PR:L), indicating that authenticated users with minimal access can trigger the flaw with reliability. The presence of a publicly available exploit (E:P) combined with confirmed exploitability evidence significantly elevates real-world risk despite the CVSS not reaching 'high' threshold. The PR:L requirement means this is not a pre-authentication attack vector, limiting exposure to users with valid system credentials. However, in multi-tenant or shared hosting scenarios where low-privileged accounts proliferate, the attack surface remains substantial. The CVSS integrity impact (I:L) is particularly concerning in a construction management context where project data accuracy is critical. While no EPSS score or KEV confirmation is provided, the combination of public POC availability, demonstrated exploitability, and unauthenticated vulnerability reports warrants prioritization in systems managing sensitive construction project data. |
| Exploit ScenarioDerived | An authenticated user with low-privilege access to the Construction Management System crafts a malicious request to /del1.php with a SQL injection payload in the toolname parameter (e.g., toolname='; DROP TABLE projects; --). The unvalidated input is concatenated into a SQL query and executed against the backend database, allowing the attacker to modify or delete construction project data, extract sensitive information such as client details or pricing, or potentially escalate privileges. Public exploit code available on GitHub (referenced in vuldb.com/submit/795444) provides ready-made payloads, reducing the technical skill required for exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the toolname parameter in /del1.php, potentially compromising data confidentiality, integrity, and availability. Publicly available exploit code exists, and the vulnerability has been assigned CVSS 6.3 with confirmed exploitability indicators (E:P rating).
RemediationAI
Apply any available security patches from itsourcecode immediately to Construction Management System installations. Implement input validation and parameterized queries (prepared statements) for all database interactions, particularly for the toolname parameter in /del1.php and similar functions. Restrict access to /del1.php and administrative functions to authorized personnel only. Deploy Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting the toolname parameter. Conduct a security audit of all PHP files accepting user input to identify and remediate similar injection vulnerabilities. Until patches are available, enforce the principle of least privilege for application database user accounts and monitor database query logs for anomalous activity. Refer to vendor advisories at itsourcecode.com for official patch releases.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in a PHP-based construction management application where user-supplied input from the toolname parameter is passed unsanitized into SQL queries executed against the backend database. This is a classic CWE-89 SQL injection flaw where insufficient input validation and parameterization allows attackers to inject malicious SQL syntax. The affected product is itsourcecode Construction Management System as identified by CPE cpe:2.3:a:itsourcecode:construction_management_system:*:*:*:*:*:*:*:*, with the vulnerable endpoint being the /del1.php file. The lack of prepared statements or parameterized queries in the toolname handling creates a direct pathway to database compromise.
Know when Construction Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /del1.php. This manipulation of the argument toolname causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
SQL injection in itsourcecode Construction Management System 1.0 allows remote unauthenticated attackers to manipulate t
SQL injection in itsourcecode Construction Management System 1.0 allows remote unauthenticated attackers to manipulate t
SQL injection in itsourcecode Construction Management System 1.0 via the code parameter in /execute.php allows remote un
A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attacker
A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers to
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to manipulate the
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to execute arbitr
Exploit-DB