Executive brief
itsourcecode Construction Management System is a web application used for managing construction projects. A security vulnerability in the system's reporting component allows an attacker to interfere with the underlying database. If exploited, this could lead to the unauthorized viewing of sensitive project data, modification of records, or disruption of the management system's operations.
Technical details
A SQL injection vulnerability exists in itsourcecode Construction Management System 1.0 within the '/borrowed_equip_report.php' file. The root cause is the improper neutralization of special elements in the 'start' (and potentially 'Home') parameter handled by the application. An attacker with low-privileged user credentials can submit malicious SQL queries via a POST request to manipulate database operations. This can lead to unauthorized data extraction (via error-based or time-based blind techniques), data tampering, or service interruption. While some reports suggest no authentication is required, the primary technical analysis indicates the vulnerability is reachable after logging in with valid credentials. No official patch is currently available; users are advised to implement prepared statements and input validation.
Affected products
- itsourcecode Construction Management System 1.0
Timeline
- 2026-03-22: disclosed: Initial disclosure on GitHub by researcher Qwh0729
- 2026-04-06: advisory: VulDB and NVD publication date