A vulnerability was detected in itsourcecode Online Medicine Delivery System 1.0. (CVE-2026-82613)

CVE-2026-82613 is a SQL injection vulnerability affecting itsourcecode Online Medicine Delivery System 1.0. The issue resides in the loadResultList function of the Product Search Interface component, specifically in the handling of the Search argument in the /index.php?q=product endpoint. An attacker can remotely manipulate this argument to perform SQL injection attacks. The vulnerability has a CVSS 3.1 score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating it is remotely exploitable with low attack complexity and no privileges or user interaction required, potentially leading to limited confidentiality, integrity, and availability impacts. Public exploit code is available, but no confirmed exploitation in the wild is reported. No vendor patch or official remediation guidance is currently available.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands remotely, potentially leading to unauthorized access to or modification of database contents. The CVSS vector indicates limited impact on confidentiality, integrity, and availability. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, it is recommended to apply input validation and sanitization on the Search argument in the Product Search Interface to mitigate SQL injection risks.