The vulnerability CVE-2026-5675 affects itsourcecode Construction Management System 1.0. It is caused by improper handling of the 'emp' parameter in the /borrowed_tool.php file, leading to SQL injection. This allows an attacker to inject malicious SQL queries remotely without requiring user interaction or elevated privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. Although an exploit is public, no official fix or patch has been documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated as medium severity with low confidentiality, integrity, and availability impacts according to the CVSS 4.0 vector. There is no indication of widespread exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries for the 'emp' parameter in /borrowed_tool.php to mitigate SQL injection risks. Monitor vendor channels for updates and apply patches promptly once released.