CVE-2026-85207: Cross Site Scripting in itsourcecode Online Medicine Delivery System

This vulnerability affects itsourcecode Online Medicine Delivery System version 1.0. It is caused by insufficient sanitization of the 'location' parameter in the /index.php?q=orderdetails endpoint, leading to cross-site scripting (CWE-79) and potentially code injection issues (CWE-94). An attacker can remotely exploit this flaw by manipulating the 'location' argument to execute arbitrary scripts in the context of the victim's browser. Public exploit code exists, but no active exploitation has been confirmed. The CVSS 3.1 base score is 5.1, indicating a medium impact with network attack vector, low attack complexity, and requiring user interaction.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of users' browsers, potentially leading to session hijacking, defacement, or other malicious actions. The vulnerability requires user interaction and low privileges to exploit. There is no indication of privilege escalation or direct system compromise from the provided data.

No official patch or fix is currently available for this vulnerability. Users of itsourcecode Online Medicine Delivery System 1.0 should apply appropriate input validation and output encoding on the 'location' parameter in /index.php?q=orderdetails to mitigate the risk. Monitor vendor advisories for any forthcoming patches or updates. Since this is not a cloud service, remediation depends on the product owner implementing fixes.