Description
A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function loadResultList of the file /index.php?q=single-item of the component Product Detail Page. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-08-31
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Patch
AI Analysis

Impact

The loadResultList routine in itsourcecode’s Online Medicine Delivery System 1.0 is vulnerable to SQL injection via an unsanitized ID parameter in the /index.php?q=single-item request. Exploiting this flaw allows a remote attacker to inject arbitrary SQL commands that are executed against the database. The injected statements can read, alter, or delete data, leading to loss of confidentiality, integrity, and potentially availability of the system.

Affected Systems

itsourcecode Online Medicine Delivery System version 1.0, accessed through the /index.php?q=single-item endpoint used to display product details. The affected component is the Product Detail Page’s loadResultList function.

Risk and Exploitability

The vulnerability has a CVSS score of 6.9, indicating a medium to high severity. No EPSS information is available, and the flaw is not listed in CISA’s KEV catalog. Attackers can trigger the flaw remotely by manipulating the ID query parameter. Based on the vulnerability’s nature, it is inferred that an attacker could potentially read, modify, or delete database content. Furthermore, it is inferred that the level of damage depends on the privileges of the database account used by the application; higher privileges would result in broader impact.

Generated by OpenCVE AI on August 31, 2026 at 05:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain and apply the vendor’s official patch or upgrade to a version where the SQL injection is fixed.
  • Validate and sanitize the ID parameter, using parameterized queries or prepared statements to prevent injection.
  • Restrict the database user account accessed by the application to the minimum privileges required for its operations.

Generated by OpenCVE AI on August 31, 2026 at 05:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 31 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function loadResultList of the file /index.php?q=single-item of the component Product Detail Page. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Title itsourcecode Online Medicine Delivery System Product Detail index.php loadResultList sql injection
First Time appeared Itsourcecode
Itsourcecode online Medicine Delivery System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:online_medicine_delivery_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode online Medicine Delivery System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Online Medicine Delivery System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-31T16:30:44.328Z

Reserved: 2026-08-30T07:43:39.932Z

Link: CVE-2026-82612

cve-icon Vulnrichment

Updated: 2026-08-31T16:30:40.766Z

cve-icon NVD

Status : Deferred

Published: 2026-08-31T04:17:28.543

Modified: 2026-08-31T20:56:08.800

Link: CVE-2026-82612

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T06:00:12Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')