CVE-2026-85205: itsourcecode Online Medicine Delivery System Wishlist controller.php addwishlist sql injection
A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addwishlist of the file /customer/controller.php?action=addwish of the component Wishlist. This manipulation of the argument proid causes sql injection. The attack may be initiated remotely.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable, but the supplied CVSS vector indicates that the attacker needs low-level privileges. No user interaction is required.
Which input and application function should defenders investigate?
Investigate the proid argument handled by the addwishlist function at /customer/controller.php?action=addwish. Manipulation of this argument is identified as the SQL injection vector.
What is the potential impact?
The provided severity vector indicates low impacts to confidentiality, integrity, and availability. The vulnerability is rated medium severity with a CVSS score of 6.3.