A flaw exists in the Construction Management System that permits an attacker to inject arbitrary SQL through the 'emp' parameter in borrowed_tool.php, a component of the Parameter Handler. The weakness stems from insufficient input validation (CWE‑74) and improper handling of SQL statements (CWE‑89). By exploiting this flaw, an attacker can read, alter, or delete database records, thereby compromising the confidentiality, integrity, and availability of project data. The vulnerability can be triggered remotely via an HTTP request to borrowed_tool.php, making it accessible from outside the organization.

The affected product is itsourcecode Construction Management System version 1.0. No other versions are explicitly listed, so the impact is limited to that release. The vulnerable component is the Parameter Handler in borrowed_tool.php.

The CVSS score of 5.3 indicates a medium severity vulnerability. The EPSS score is not available, so the current exploitation prevalence is unknown, and the vulnerability is not listed in CISA's KEV catalog. However, the exploit has been made public and can be launched remotely, increasing the likelihood of real‑world attacks. Successful exploitation could allow attackers to gain unauthorized database access, leading to data theft, modification, or denial of service.