itsourcecode Construction Management System EUVD-2026-25749

No authentication is required - the vulnerability is exploitable by remote attackers without credentials (PR:N per CVSS vector). The manipulation must target the code parameter in /execute.php specifically. The attack vector is network-based (AV:N) with low complexity (AC:L), meaning no special network conditions, proxies, or complex attack chains are necessary. The vulnerability exists in the default or typical deployment of itsourcecode Construction Management System 1.0 without requiring non-standard configuration. The only limiting factor is whether the /execute.php endpoint is reachable from the attacker's network perspective - if the application is not internet-facing or is behind proper access controls, exploitation is prevented.

The CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) indicates network-accessible, low-complexity exploitation requiring no privileges or user interaction, with limited confidentiality, integrity, and availability impact. This suggests the vulnerability is remotely exploitable against default configurations with modest direct system damage; however, the 'L' (Low) impact ratings across all three CIA triad elements indicate the vulnerability does not grant full database compromise or system control. The presence of publicly available exploit code (POC) lowers the barrier to exploitation, but the lack of CISA KEV status at the time of analysis suggests this may not be actively exploited at scale in the wild. The combination of network accessibility and unauthenticated exploitation (PR:N) makes this a genuine priority for organizations running itsourcecode 1.0, despite the limited CIA impact. Real-world risk depends heavily on the sensitivity of data stored in the affected application's database and whether the system is internet-facing.

An attacker crafts a malicious HTTP request to /execute.php with SQL injection payloads in the code parameter - for example, code=1' OR '1'='1 or code=1; DROP TABLE users; -- - to manipulate the database query. Due to the lack of input validation, the injected SQL syntax is parsed and executed by the database backend, allowing the attacker to extract sensitive data, modify records, or potentially escalate privileges depending on database user permissions. The publicly available exploit code on GitHub (referenced in sources) lowers the technical barrier, enabling less skilled attackers to attempt exploitation.