Quick answers
- Is CVE-2026-82612 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82612 being exploited in the wild.
- How severe is CVE-2026-82612?
- High severity, with a CVSS score of 7.3, published 31 August 2026.
- Which products and versions are affected?
- Itsourcecode Online Medicine Delivery System 1.0.
- Is there a fix for CVE-2026-82612?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-82612 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-82612?
- Check whether you run Itsourcecode Online Medicine Delivery System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a classic SQL injection vulnerability in the product detail page (/index.php?q=single-item) where the 'id' parameter is directly concatenated into a multi-table SQL query without sanitization, escaping, or type validation. The vulnerable code in single-item.php receives the user-supplied id parameter and passes it directly to a SELECT query joining tblpromopro, tblproduct, and tblcategory tables. An unauthenticated attacker can exploit this via multiple injection vectors: UNION-based injection to directly extract data, error-based injection, and time-based blind SQL injection. The results are rendered directly to the page via loadResultList(), making UNION injection particularly effective for data exfiltration. Remediation requires parameterized queries and integer type validation on the id parameter.
Affected products
- itsourcecode Online Medicine Delivery System 1.0
Timeline
- 2026-08-31: disclosed
- 2026-08-31: advisory: CVE-2026-82612