Executive brief
A security vulnerability exists in the itsourcecode Construction Management System, a software platform used for managing construction projects. An attacker with basic user credentials can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the theft of sensitive project information, unauthorized modification of records, or disruption of the management system's operations.
Technical details
A SQL injection vulnerability exists in the '/del.php' component of itsourcecode Construction Management System 1.0. The root cause is the improper neutralization of special elements within the 'equipname' POST parameter, which is used in SQL queries without sufficient sanitization or parameterization. An attacker with low-privileged authentication can exploit this via network requests to perform boolean-based, error-based, or time-based blind SQL injection. Successful exploitation allows for unauthorized database access, data exfiltration, and potential system control. No official patch has been identified, but remediation involves implementing prepared statements and input validation.
Affected products
- itsourcecode Construction Management System 1.0
Timeline
- 2026-04-01: disclosed: Vulnerability discovered and reported on GitHub by user ltranquility
- 2026-04-10: advisory: CVE-2026-6007 published