The itsourcecode Construction Management System 1.0 contains a SQL injection vulnerability in the /del1.php file due to improper sanitization of the 'toolname' parameter. This allows an attacker to remotely inject SQL commands, potentially compromising the backend database. The vulnerability has a CVSS 4.0 score of 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. No official fix or patch has been published, and the vendor has not provided remediation details.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The medium CVSS score reflects limited impact due to low privileges required but low confidentiality, integrity, and availability impacts. There are no confirmed active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'toolname' parameter in /del1.php. Restricting database permissions and monitoring for suspicious activity related to this endpoint may also help reduce risk.