itsourcecode Construction Management System borrowed_tool_report.php SQLインジェクション

Successful exploitation of CVE-2026-5823 could allow an attacker to bypass authentication and gain unauthorized access to sensitive data stored within the itsourcecode Construction Management System's database. This could include confidential project details, financial records, user credentials, and other critical information. Depending on the database permissions, an attacker might even be able to modify or delete data, leading to data integrity issues and operational disruptions. The public availability of an exploit significantly increases the risk of widespread exploitation.

Organizations utilizing the itsourcecode Construction Management System, particularly those with publicly accessible instances or those lacking robust input validation practices, are at significant risk. Shared hosting environments where multiple users share the same server instance are also particularly vulnerable, as a compromise of one user's account could potentially lead to the compromise of the entire system.

• php / web:

grep -r "Home = " /var/www/itsourcecode/borrowed_tool_report.php

• generic web:

curl -I http://your-server/borrowed_tool_report.php?Home='OR'1'-- -v | grep SQL

1. 2026-04-08Disclosure

   disclosure

1. 予約済み2026-04-08
2. 公開日2026-04-08
3. 更新日2026-04-09
4. EPSS 更新日2026-04-16

The primary mitigation for CVE-2026-5823 is to upgrade to a patched version of the itsourcecode Construction Management System as soon as it becomes available. Until a patch is applied, consider implementing temporary workarounds such as input validation and sanitization on the Home parameter within the /borrowedtoolreport.php file. Web application firewalls (WAFs) configured to detect and block SQL Injection attempts can also provide a layer of protection. Monitor access logs for suspicious SQL queries targeting the vulnerable endpoint.