The itsourcecode Construction Management System 1.0 contains a SQL injection vulnerability in the /del.php file. Specifically, the equipname argument is not properly sanitized, allowing an attacker to inject SQL commands remotely. This vulnerability could potentially allow unauthorized database queries or modifications. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability. No official fix or patch has been published as of the data provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated as medium with limited confidentiality, integrity, and availability impacts according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor communications for updates. Until a patch is released, consider restricting access to the affected endpoint or implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the equipname parameter.