Executive summary — CVE-2026-6007 is a SQL injection flaw in itsourcecode Construction Management System v1.0, specifically in the /del.php endpoint. An attacker who can reach this functionality (requires valid credentials per the references) can manipulate the equipname parameter to inject SQL, potentially leading to unauthorized database actions. The vulnerability is remotely exploitable and has been publicly disclosed.
Technical details — The root cause is improper sanitization/validation of the user-controlled equipname parameter before it is used in SQL queries within /del.php. The references state that after logging in with valid credentials, an attacker can inject malicious SQL through equipname because the application “fails to properly sanitize or validate this input before using it in SQL queries,” allowing manipulation of the resulting SQL statement.
The public PoC methodology described in the GitHub submission demonstrates multiple SQL injection techniques against MySQL, including:
- Boolean-based blind injection using a crafted condition (e.g., leveraging RLIKE with a subquery/CASE expression) to infer true/false behavior without direct output.
- Error-based injection using MySQL functions (e.g., GTID_SUBSET with concatenated markers) to trigger errors that reveal information.
- Time-based blind injection (the reference indicates a time-based blind approach was also used) to infer results by measuring response delays.
Overall, the exploit mechanism is: authenticate (per the references), send a POST request to /del.php with a manipulated equipname value, and use SQL payload logic to alter or infer the backend query behavior.
Impact — With SQL injection, an attacker may be able to read or modify data and potentially take broader actions depending on the privileges of the database user used by the application. The references explicitly mention potential outcomes such as unauthorized database access, sensitive data leakage, data tampering, comprehensive system control, and service interruption.
The provided CVSS is 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating medium severity with remote network attack, low attack complexity, and low privileges required. The scope is unchanged (S:U) and confidentiality/integrity/availability impacts are each listed as low (C:L/I:L/A:L). Real-world risk is elevated because the vulnerability is remotely reachable and the exploit approach is publicly available.
Mitigation — The references identify the affected product version as Construction Management System v1.0 and the vulnerable file as /del.php with the equipname parameter. The most direct mitigation is to patch/upgrade the application to a version where /del.php no longer constructs SQL queries using unsanitized user input.
If patching is not immediately possible, mitigations should focus on eliminating SQL injection risk in the equipname handling path:
- Ensure equipname is never concatenated into SQL strings; use parameterized queries/prepared statements for all database operations involving equipname.
- Apply strict input validation for equipname consistent with expected data types/allowed values (validation alone should not replace parameterization).
- Review database permissions for the application’s DB user to ensure it has the minimum privileges needed, reducing the blast radius of any injection.
Detection guidance (based on the described attack surface): monitor for authenticated POST requests to /del.php containing suspicious SQL metacharacters and patterns in equipname (e.g., quotes, SQL keywords, boolean logic constructs, and MySQL-specific functions referenced in the PoC such as RLIKE/GTID_SUBSET), and alert on abnormal request rates or error/time-based behavior consistent with blind SQLi attempts.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE-74