A flaw exists in itsourcecode Construction Management System version 1.0; a function inside the file del1.php accepts a toolname parameter that is not properly sanitized. Manipulating this argument allows an attacker to inject arbitrary SQL statements. The vulnerability is exploitable from a remote host, and an exploit has already been published for the public based on this flaw. The impact includes unauthorized data access, alteration, or deletion within the database, and potentially wider system compromise if the database has elevated privileges.

All installations of itsourcecode Construction Management System 1.0 are vulnerable, as the flaw appears in the del1.php file of that release. No other versions are specified as affected, but any deployment using this file and accepting the toolname parameter is at risk until a patch or mitigation is applied.

The CVSS score of 5.3 indicates moderate impact, yet the exploitation path is straightforward: send a crafted request to del1.php from a remote location, inject SQL, and read or modify data. The EPSS score is not available, but the existence of a published exploit suggests a realistic threat. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, yet the public nature of the exploit increases likelihood of real-world attacks.