This vulnerability affects itsourcecode Construction Management System 1.0 and involves an SQL injection flaw in the Parameter Handler component of the /borrowed_equip_report.php file. By manipulating the 'Home' parameter, an attacker can inject SQL commands remotely. The vulnerability has a CVSS 4.0 score of 5.3, indicating medium severity. No official fix or patch has been published, and the exploit details are publicly known.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability. There is no indication of privilege escalation or user interaction requirements. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable parameter to untrusted inputs where possible.