Description
A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addwishlist of the file /customer/controller.php?action=addwish of the component Wishlist. This manipulation of the argument proid causes sql injection. The attack may be initiated remotely.
Published: 2026-09-03
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the addwishlist function of itsourcecode Online Medicine Delivery System version 1.0 allows an attacker to manipulate the proid argument and inject arbitrary SQL commands. The injection can be triggered remotely via the web interface, potentially granting the attacker the ability to read, modify, or delete data stored in the database. The vulnerability is classified with a moderate CVSS score of 5.3 under CWE-74 (Improper Neutralization of Input During Database Query) and CWE-89 (SQL Injection).

Affected Systems

The affected software is itsourcecode Online Medicine Delivery System, version 1.0. No additional affected versions are specified beyond this release.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score is unavailable and the vulnerability is not listed in CISA KEV catalogues, suggesting limited publicly observed exploitation. Exploitation requires only remote access to the web interface and the ability to send a crafted proid value to the addwishlist endpoint. No special privileges or pre‑existing user access are required beyond reaching the vulnerable page.

Generated by OpenCVE AI on September 3, 2026 at 21:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch for Online Medicine Delivery System 1.0 to correct the SQL injection flaw.
  • Sanitize and validate the proid input on the server side, ensuring it contains only numeric values before inclusion in database queries.
  • Restrict access to the addwishlist endpoint so that only authenticated and authorized users can invoke it.

Generated by OpenCVE AI on September 3, 2026 at 21:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 19:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addwishlist of the file /customer/controller.php?action=addwish of the component Wishlist. This manipulation of the argument proid causes sql injection. The attack may be initiated remotely.
Title itsourcecode Online Medicine Delivery System Wishlist controller.php addwishlist sql injection
First Time appeared Itsourcecode
Itsourcecode online Medicine Delivery System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:online_medicine_delivery_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode online Medicine Delivery System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Itsourcecode Online Medicine Delivery System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-03T19:00:12.323Z

Reserved: 2026-09-03T13:12:29.324Z

Link: CVE-2026-85205

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-03T19:17:30.230

Modified: 2026-09-03T19:17:30.230

Link: CVE-2026-85205

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T23:30:10Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')