Executive brief
itsourcecode Construction Management System is a web-based application used to manage construction projects and resources. A security flaw in the system's tool deletion functionality allows an authenticated user to perform unauthorized database operations. This could lead to the exposure of sensitive project data, unauthorized modification of records, or disruption of the management platform.
Technical details
A SQL injection vulnerability exists in itsourcecode Construction Management System 1.0 within the /del1.php component. The application fails to properly sanitize or validate the 'toolname' POST parameter before incorporating it into a database query. An attacker with valid login credentials can submit crafted SQL payloads to perform boolean-based blind, error-based, or time-based blind injection. Successful exploitation allows for unauthorized database access, data leakage, and potential tampering with system records. A public exploit (PoC) using sqlmap has been disclosed.
Affected products
- itsourcecode Construction Management System 1.0
Timeline
- 2026-04-02: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-04-10: advisory: Initial advisory publication.