Description
A vulnerability was detected in itsourcecode Online Medicine Delivery System 1.0. This affects the function loadResultList of the file /index.php?q=product of the component Product Search Interface. Performing a manipulation of the argument Search results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.
Published: 2026-08-31
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A SQL injection flaw exists in the loadResultList function of index.php for the Product Search Interface in itsourcecode Online Medicine Delivery System. By manipulating the Search argument, an attacker can inject malicious SQL commands, potentially compromising database integrity and confidentiality. The flaw allows remote exploitation with no authentication required and the public exploit is available, raising the risk of data exposure or unauthorized data manipulation.

Affected Systems

The vulnerability affects the itsourcecode Online Medicine Delivery System version 1.0, specifically the component /index.php?q=product within the Product Search Interface.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium to high severity. EPSS information is unavailable, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be remote, initiated via HTTP requests to the vulnerable endpoint. Given the public nature of the exploit and the lack of a requirement for local or privileged access, the risk remains significant until a patch is applied.

Generated by OpenCVE AI on August 31, 2026 at 05:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest vendor patch that addresses the SQL injection in the search interface
  • Add server‑side input validation and parameterized queries to prevent injection attempts
  • Configure the database user used by the application with the minimum privileges required and monitor for suspicious queries

Generated by OpenCVE AI on August 31, 2026 at 05:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 04:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in itsourcecode Online Medicine Delivery System 1.0. This affects the function loadResultList of the file /index.php?q=product of the component Product Search Interface. Performing a manipulation of the argument Search results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.
Title itsourcecode Online Medicine Delivery System Product Search index.php loadResultList sql injection
First Time appeared Itsourcecode
Itsourcecode online Medicine Delivery System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:online_medicine_delivery_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode online Medicine Delivery System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Online Medicine Delivery System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-31T04:00:10.725Z

Reserved: 2026-08-30T07:43:43.988Z

Link: CVE-2026-82613

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-31T04:17:28.777

Modified: 2026-08-31T04:17:28.777

Link: CVE-2026-82613

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T05:30:03Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')