Executive brief
itsourcecode Construction Management System is a web-based application used for managing construction projects and personnel. A security vulnerability in the employee management module allows an authenticated user to perform unauthorized database operations. This could lead to the exposure of sensitive employee information, data tampering, or disruption of the management system's operations.
Technical details
A SQL injection vulnerability exists in itsourcecode Construction Management System 1.0 within the '/employees.php' file. The root cause is the improper neutralization of special elements in the 'Name' POST parameter, which is used in SQL commands without sufficient sanitization or parameterization. An attacker with valid user credentials can exploit this via the network to execute arbitrary SQL queries. Successful exploitation can lead to unauthorized database access, sensitive data leakage, or data modification. Public exploits, including error-based and time-based blind payloads, have been disclosed.
Affected products
- itsourcecode Construction Management System 1.0
Timeline
- 2026-04-05: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-04-13: advisory: CVE-2026-6190 published