itsourcecode Construction Management System SQL Injection Vulnerability

A SQL injection vulnerability has been identified in itsourcecode Construction Management System version 1.0. The vulnerability resides within the /locations.php file and is triggered by manipulating the address argument. This allows a remote attacker to inject arbitrary SQL commands into the application’s database queries. This poses a significant risk as successful exploitation could lead to unauthorized data access, modification, or deletion, potentially compromising the entire system. The vulnerability has been assigned CVE-2026-7075, and a public exploit is available, increasing the likelihood of exploitation.

Attack Chain

1. Attacker identifies an instance of itsourcecode Construction Management System 1.0.
2. Attacker sends a crafted HTTP request to /locations.php with a malicious SQL payload embedded in the address parameter.
3. The application fails to properly sanitize the address parameter.
4. The unsanitized input is incorporated into an SQL query.
5. The database executes the attacker-controlled SQL query.
6. The attacker extracts sensitive data from the database.
7. Attacker may use the injected queries to modify or delete data.
8. The attacker compromises the confidentiality, integrity, and availability of the Construction Management System.

Impact

Successful exploitation of this SQL injection vulnerability (CVE-2026-7075) can lead to unauthorized access to sensitive data, including user credentials, financial records, and project details stored within the Construction Management System database. Attackers could potentially modify or delete critical data, disrupt business operations, or gain complete control over the application and its underlying infrastructure. Given the public availability of the exploit, organizations using the affected version of itsourcecode Construction Management System are at immediate risk.

Recommendation

• Deploy the provided Sigma rule to detect suspicious HTTP requests to /locations.php containing potentially malicious SQL syntax in the cs-uri-query (webserver logs).
• Implement input validation and sanitization for the address parameter in /locations.php to prevent SQL injection attacks.
• Monitor web server logs for unusual activity, especially requests targeting /locations.php with long or complex address parameters.