CVE-2026-85207: Cross Site Scripting in itsourcecode Online Medicine Delivery System

This vulnerability affects itsourcecode Online Medicine Delivery System version 1.0. It involves a cross-site scripting (XSS) flaw in an unspecified function within the /index.php?q=orderdetails file. The vulnerability arises from improper handling of the 'location' argument, allowing an attacker to inject malicious scripts. The attack vector is network-based with low attack complexity and requires user interaction. The vulnerability does not require elevated privileges and does not bypass any security controls. Public exploit code exists, but no known in-the-wild exploitation has been documented. No official fix or mitigation has been published to date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application for users who visit the manipulated URL. This could lead to session hijacking, defacement, or other client-side impacts. However, the vulnerability requires user interaction and low privileges, limiting the scope of impact. There is no indication of server-side compromise or data breach from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with URLs involving the affected parameter. Implementing web application firewalls (WAFs) with XSS filtering and input validation on the 'location' parameter may help mitigate exploitation risk. Monitor vendor channels for updates or patches.