CVE-2026-82612: SQL Injection in itsourcecode Online Medicine Delivery System

The vulnerability CVE-2026-82612 affects itsourcecode Online Medicine Delivery System version 1.0. It is a SQL injection issue in the loadResultList function within the /index.php?q=single-item endpoint of the Product Detail Page component. By manipulating the ID parameter, an attacker can inject SQL commands remotely. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impacts on confidentiality, integrity, and availability. Although exploit code has been publicly disclosed, there is no evidence of widespread exploitation. No remediation level or patch information is provided by the vendor or authoritative sources.

Successful exploitation allows remote attackers to perform SQL injection via the ID parameter, potentially leading to unauthorized access or modification of the database. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts as per the CVSS vector. There is no indication of privilege escalation or requirement for user interaction, increasing the risk of remote exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. In the meantime, applying input validation and parameterized queries on the affected parameter may reduce risk. No vendor advisory states 'no action required' or 'already mitigated'.