CVE-2026-82613: itsourcecode Online Medicine Delivery System Product Search index.php loadResultList sql injection
A vulnerability was detected in itsourcecode Online Medicine Delivery System 1.0. This affects the function loadResultList of the file /index.php?q=product of the component Product Search Interface. Performing a manipulation of the argument Search results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Instances of itsourcecode Online Medicine Delivery System 1.0 that expose the Product Search Interface at /index.php?q=product are affected. The attack can be initiated remotely and requires no privileges or user interaction.
What does an attacker need to exploit it?
An attacker needs to manipulate the Search argument handled by the loadResultList function. Public exploit availability is reported, which may lower the effort needed to attempt exploitation.
What can be done if patching is not immediately possible?
The provided information does not identify a vendor fix or workaround. As an interim measure, restrict public access to the affected Product Search Interface where operationally feasible and monitor requests to /index.php?q=product for suspicious search-parameter manipulation.