# CVE-2026-82611: itsourcecode Online Medicine Delivery System SQL injection in login

Source: https://junglewise.ai/threats/cve-2026-82611-itsourcecode-online-medicine-delivery-system-sql-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82611 · Severity: high · CVSS 7.3 · Published 2026-08-31

itsourcecode Online Medicine Delivery System is a PHP-based platform for managing online medicine orders and customer accounts. An attacker can bypass customer authentication by injecting malicious SQL into the login form, gaining unauthorized access to any customer account without knowing their password. Once inside, attackers can place fraudulent orders, steal personal information, modify customer data, and tamper with account settings.

Technologies: [Itsourcecode Online Medicine Delivery System](https://junglewise.ai/threats/technologies/online-medicine-delivery-system). Vendors: [Itsourcecode](https://junglewise.ai/threats/vendors/itsourcecode).

## Quick answers

**Is CVE-2026-82611 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82611 being exploited in the wild.

**How severe is CVE-2026-82611?** High severity, with a CVSS score of 7.3, published 31 August 2026.

**Which products and versions are affected?** Itsourcecode Online Medicine Delivery System 1.0.

**Is there a fix for CVE-2026-82611?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82611 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82611?** Check whether you run Itsourcecode Online Medicine Delivery System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a SQL injection flaw in the Customer::cusAuthentication() method (include/customers.php) triggered via the U_USERNAME parameter in /login.php. User input is concatenated directly into an SQL WHERE clause without parameterization or input validation, allowing attackers to craft payloads (e.g., ' OR 1=1-- -) that bypass password checks. The attack requires no authentication and is remotely exploitable via POST requests. Both the sidebarLogin and modalLogin code branches are affected. Attackers can achieve Boolean-based and time-based SQL injection to enumerate data or extract credentials. Remediation requires parameterized queries and strict input validation.

## Affected products

- itsourcecode Online Medicine Delivery System 1.0

## Timeline

- 2026-08-31: disclosed

## References

- [https://github.com/boyslikesports/202607_vul_dir/blob/main/C-02-SQLi-Customer-Auth-Bypass_en.md](https://github.com/boyslikesports/202607_vul_dir/blob/main/C-02-SQLi-Customer-Auth-Bypass_en.md)
- [https://itsourcecode.com/](https://itsourcecode.com/)

## Related threats

- [itsourcecode Online Medicine Delivery System unrestricted file upload in order management](https://junglewise.ai/threats/cve-2026-85208-itsourcecode-online-medicine-delivery-system-unrestricted-file)
- [itsourcecode Online Medicine Delivery System reflected XSS in orderdetails](https://junglewise.ai/threats/cve-2026-85207-itsourcecode-online-medicine-delivery-system-reflected-xss-in)
- [itsourcecode Online Medicine Delivery System SQL injection in addwishlist](https://junglewise.ai/threats/cve-2026-85205-itsourcecode-online-medicine-delivery-system-sql-injection-in)
- [itsourcecode Online Medicine Delivery System SQL injection in order status update](https://junglewise.ai/threats/cve-2026-85187-itsourcecode-online-medicine-delivery-system-sql-injection-in)
- [itsourcecode Online Medicine Delivery System unrestricted file upload](https://junglewise.ai/threats/cve-2026-85186-itsourcecode-online-medicine-delivery-system-unrestricted-file)