This vulnerability affects itsourcecode Construction Management System 1.0 and involves SQL injection via the 'code' parameter in the /execute.php file. The injection flaw allows an unauthenticated remote attacker to manipulate SQL queries, potentially impacting the confidentiality and integrity of the database. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability. No vendor patch or official remediation has been published as of the data provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely without authentication. This may lead to unauthorized data access or modification. However, the impact is rated medium due to low to limited impact on confidentiality, integrity, and availability as per the CVSS vector. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the /execute.php endpoint and restrict access to the vulnerable parameter if possible. Monitor vendor channels for updates and apply patches promptly once released.