Executive brief
The itsourcecode Construction Management System is a web application used for managing construction projects and equipment. A security vulnerability in the equipment management module allows an authenticated user to perform unauthorized database operations. This could lead to the exposure of sensitive project data, unauthorized modification of records, or disruption of the management system's operations.
Technical details
A SQL injection vulnerability exists in itsourcecode Construction Management System 1.0 within the /equipments.php file. The root cause is the improper sanitization of the 'Name' POST parameter before it is used in a database query. An attacker with valid user credentials can exploit this by submitting a crafted 'Name' argument containing malicious SQL commands. Successful exploitation allows for error-based SQL injection, potentially leading to unauthorized database access, data leakage, or data tampering. A public exploit using the EXTRACTVALUE function has been disclosed.
Affected products
- itsourcecode Construction Management System 1.0
Timeline
- 2026-04-05: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-04-13: advisory: NVD publication date