PT-2026-30604 · Itsourcecode · Itsourcecode Construction Management System

Yeliuyun · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-5660

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions itsourcecode Construction Management System version 1.0

Description A SQL injection issue exists in itsourcecode Construction Management System version 1.0. The issue is located in an unknown function within the /borrowed equip.php file of the Parameter Handler component. Manipulation of the emp argument can lead to SQL injection. The attack can be initiated remotely and has been publicly disclosed.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the /borrowed equip.php file or the Parameter Handler component.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-5660

Affected Products

Itsourcecode Construction Management System

References · 9

• 🔥 https://github.com/Learner636/CVE-smbmit/issues/4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5660 · Security Note
• https://vuldb.com/submit/786062 · Note
• https://twitter.com/infoflowcloud/status/2041173168958664757 · Twitter Post
• https://vuldb.com/vuln/355484/cti · Note
• https://vuldb.com/vuln/355484 · Note
• https://twitter.com/VulmonFeeds/status/2041163906798743591 · Twitter Post
• https://twitter.com/CVEnew/status/2041171327030112592 · Twitter Post
• https://itsourcecode.com · Note