Executive brief
The itsourcecode Online Medicine Delivery System is a PHP-based application for managing medicine orders and delivery. An attacker can inject arbitrary SQL commands through the product detail page without authentication, potentially exposing the entire database including customer personal information, order data, and user password hashes.
Technical details
This is a classic SQL injection vulnerability in the product detail page (/index.php?q=single-item) where the 'id' parameter is directly concatenated into a multi-table SQL query without sanitization, escaping, or type validation. The vulnerable code in single-item.php receives the user-supplied id parameter and passes it directly to a SELECT query joining tblpromopro, tblproduct, and tblcategory tables. An unauthenticated attacker can exploit this via multiple injection vectors: UNION-based injection to directly extract data, error-based injection, and time-based blind SQL injection. The results are rendered directly to the page via loadResultList(), making UNION injection particularly effective for data exfiltration. Remediation requires parameterized queries and integer type validation on the id parameter.
Affected products
- itsourcecode Online Medicine Delivery System 1.0
Timeline
- 2026-08-31: disclosed
- 2026-08-31: advisory: CVE-2026-82612