Executive brief
A security vulnerability exists in the itsourcecode Construction Management System, a software platform used for managing construction projects. An attacker with basic user credentials can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the theft of sensitive project data, unauthorized modification of records, or disruption of the system's operations.
Technical details
A SQL injection vulnerability exists in itsourcecode Construction Management System V1.0 within the 'emp_id' parameter of the /borrowedequip.php component. The application fails to properly sanitize or validate user-supplied input before incorporating it into SQL queries. A remote attacker with low-level authenticated access can exploit this by sending specially crafted GET requests, potentially using time-based blind injection techniques (e.g., using SLEEP functions). Successful exploitation allows for unauthorized database access, data leakage, and potential system control. A proof-of-concept exploit using sqlmap has been publicly disclosed.
Affected products
- itsourcecode Construction Management System 1.0
Timeline
- 2026-03-30: disclosed: Initial disclosure on GitHub issues
- 2026-04-06: advisory: VulDB and NVD publication