The affected file execute.php processes a parameter named code, which is used directly in SQL queries. This omission of proper input validation enables a malicious user to inject arbitrary SQL statements. The result is remote SQL injection that can lead to unauthorized disclosure, modification, or deletion of database contents, compromising confidentiality, integrity, and possibly availability of the system. The weakness matches CWE-74 and CWE-89.

The vulnerability exists in itsourcecode Construction Management System version 1.0. The impacted component resides in an unknown portion of execute.php. Only the vendor itsourcecode and product Construction Management System are listed as affected; no further version details are provided beyond 1.0.

The CVSS score of 6.9 indicates a moderate severity for remote exploitation. The EPSS score is less than 1%, suggesting that the probability of exploitation in the wild is low, and the vulnerability is not included in the CISA KEV catalog. Nevertheless, because the flaw is exploitable remotely and published exploits have been released, attackers can potentially craft HTTP requests targeting the code parameter. Successful exploitation would grant the attacker the ability to execute arbitrary SQL, leading to data compromise or manipulation.