A vulnerability has been found in itsourcecode Online Medicine Delivery System 1.0. (CVE-2026-82615)

The vulnerability in itsourcecode Online Medicine Delivery System 1.0 affects the Password Recovery Interface component, specifically the Customer::find_phone function in /passwordrecover.php. By manipulating the phonenumber argument, an attacker can perform SQL injection, which may compromise confidentiality, integrity, and availability of the system. The vulnerability is remotely exploitable without authentication and has been publicly disclosed. No official fix or patch has been provided as of the published date.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized disclosure of sensitive information, data modification, or disruption of service. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability, all at a low level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and parameterized queries to the phonenumber parameter in the Password Recovery Interface to mitigate SQL injection risks.