This vulnerability involves an SQL injection flaw in itsourcecode Construction Management System 1.0, specifically related to the 'Home' argument in the /borrowed_tool_report.php file. An attacker can remotely manipulate this argument to inject SQL commands, potentially compromising the database. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability. The vulnerability is publicly known but no official fix or patch has been released.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated as medium with low confidentiality, integrity, and availability impacts according to the CVSS vector. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected functionality and monitor for suspicious activity related to the /borrowed_tool_report.php endpoint. Avoid using version 1.0 in production environments if possible.