This vulnerability in itsourcecode Construction Management System 1.0 involves SQL injection via manipulation of the 'emp' parameter in the /borrowed_equip.php file's Parameter Handler component. The flaw allows an unauthenticated remote attacker to inject SQL commands due to insufficient input validation or sanitization. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability is publicly disclosed but no vendor-provided fix or mitigation is documented.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the low scope and low integrity and availability impacts as per the CVSS vector. There are no confirmed active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or web application firewall rules to detect and block SQL injection attempts targeting the 'emp' parameter in /borrowed_equip.php. Monitor vendor channels for updates.