A flaw in the Construction Management System 1.0 allows an attacker to manipulate the Name argument in the /equipments.php page. The input is directly incorporated into a SQL query, giving the attacker the ability to inject arbitrary SQL statements. This can lead to unauthorized read, modification, or deletion of the system database, potentially exposing sensitive business and client information.

The vulnerability affects the itsourcecode Construction Management System, version 1.0. No other versions are listed, so the impact is confined to installations of this specific product and version.

The CVSS base score of 5.3 indicates a moderate severity. No EPSS score is available, and the issue is not in the CISA KEV catalog, though it has been publicly disclosed. The exploit can be triggered remotely via the web interface, so any environment exposing the application to the internet is at risk. If the attacker can reach the vulnerable endpoint, exploitation likely succeeds on systems that do not employ additional mitigations such as input validation or a web application firewall.