This vulnerability affects itsourcecode Construction Management System 1.0 and is triggered by improper handling of the address argument in /locations.php, leading to SQL injection. The flaw allows an unauthenticated remote attacker to manipulate SQL queries, potentially compromising the database integrity or confidentiality. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low to limited impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and the exploit code has been publicly disclosed.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity with limited confidentiality, integrity, and availability impact as per the CVSS vector. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewall (WAF) rules to block malicious payloads targeting the address parameter in /locations.php. Monitor vendor channels for updates and apply patches promptly once released.