A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. (CVE-2026-85205)

The vulnerability identified as CVE-2026-85205 affects itsourcecode Online Medicine Delivery System version 1.0. It is located in the addwishlist function within the Wishlist component, specifically in the /customer/controller.php?action=addwish file. The issue arises from improper sanitization of the proid argument, which can be manipulated to perform SQL injection attacks. This vulnerability can be exploited remotely by an attacker with low privileges and does not require user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and impacts on confidentiality, integrity, and availability rated as low, low, and low respectively.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized disclosure of information, modification of data, or disruption of service. The impact is rated as medium severity with partial loss of confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Until a fix is available, restrict access to the vulnerable functionality and monitor for suspicious activity related to the addwishlist function.