CVE-2026-82613: SQL Injection in itsourcecode Online Medicine Delivery System

The vulnerability CVE-2026-82613 exists in itsourcecode Online Medicine Delivery System 1.0 within the loadResultList function of the Product Search Interface component. An attacker can remotely exploit this by manipulating the Search parameter in the /index.php?q=product endpoint to perform SQL injection. This could potentially allow unauthorized access or modification of the backend database. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. Exploit code is publicly available, increasing the risk of exploitation. No official patch or remediation level has been disclosed by the vendor.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider applying input validation or web application firewall rules to mitigate SQL injection risks in the Search parameter.