This vulnerability involves an SQL injection in the itsourcecode Construction Management System 1.0, specifically in an unknown function of the /del1.php file. The injection occurs through the 'toolname' parameter, enabling an attacker to manipulate backend SQL queries remotely without requiring user interaction or elevated privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. No vendor-provided patch or fix is documented, and the product is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation allows remote attackers to perform SQL injection attacks via the 'toolname' parameter in /del1.php, potentially leading to unauthorized data access or modification. The vulnerability does not require user interaction and has low complexity but limited impact as indicated by the CVSS vector. No known exploits are currently observed in the wild, but a public exploit exists.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation and parameterized queries as temporary mitigations. Monitoring for unusual database activity related to the 'toolname' parameter may also help detect exploitation attempts.