CVE-2026-5620

Root

Cause A SQL injection vulnerability exists in the /borrowed_equip_report.php file of itsourcecode Construction Management System 1.0. The application fails to sanitize the 'start' parameter before using it in SQL queries, allowing an attacker to inject malicious SQL code. The root cause is improper input validation [1].

Exploitation

The attack can be initiated remotely. While some descriptions mention authentication, the provided exploit proof-of-concept (POC) does not require valid credentials, and the reference explicitly states "NO AUTHENTICATION REQUIRED" [1]. An attacker can send a crafted POST request with a malicious 'start' parameter to trigger error-based or time-based blind SQL injection.

Impact

Successful exploitation allows an attacker to access, modify, or delete sensitive database content. This could lead to unauthorized data leakage, data tampering, and potential control over the application's database [1].

Mitigation

As of the publication date, no official patch has been released by the vendor. The vulnerability has been publicly disclosed and exploit code is available. Administrators should consider implementing input validation and parameterized queries as a workaround, or restrict access to the affected file [1].