# CVE-2026-82612: itsourcecode Online Medicine Delivery System SQL injection in product detail

Source: https://junglewise.ai/threats/cve-2026-82612-itsourcecode-online-medicine-delivery-system-sql-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82612 · Severity: high · CVSS 7.3 · Published 2026-08-31

The itsourcecode Online Medicine Delivery System is a PHP-based application for managing medicine orders and delivery. An attacker can inject arbitrary SQL commands through the product detail page without authentication, potentially exposing the entire database including customer personal information, order data, and user password hashes.

Technologies: [Itsourcecode Online Medicine Delivery System](https://junglewise.ai/threats/technologies/online-medicine-delivery-system). Vendors: [Itsourcecode](https://junglewise.ai/threats/vendors/itsourcecode).

## Quick answers

**Is CVE-2026-82612 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82612 being exploited in the wild.

**How severe is CVE-2026-82612?** High severity, with a CVSS score of 7.3, published 31 August 2026.

**Which products and versions are affected?** Itsourcecode Online Medicine Delivery System 1.0.

**Is there a fix for CVE-2026-82612?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82612 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-82612?** Check whether you run Itsourcecode Online Medicine Delivery System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a classic SQL injection vulnerability in the product detail page (/index.php?q=single-item) where the 'id' parameter is directly concatenated into a multi-table SQL query without sanitization, escaping, or type validation. The vulnerable code in single-item.php receives the user-supplied id parameter and passes it directly to a SELECT query joining tblpromopro, tblproduct, and tblcategory tables. An unauthenticated attacker can exploit this via multiple injection vectors: UNION-based injection to directly extract data, error-based injection, and time-based blind SQL injection. The results are rendered directly to the page via loadResultList(), making UNION injection particularly effective for data exfiltration. Remediation requires parameterized queries and integer type validation on the id parameter.

## Affected products

- itsourcecode Online Medicine Delivery System 1.0

## Timeline

- 2026-08-31: disclosed
- 2026-08-31: advisory: CVE-2026-82612

## References

- [https://github.com/boyslikesports/202607_vul_dir/blob/main/C-03-SQLi-Single-Item-ID_en.md](https://github.com/boyslikesports/202607_vul_dir/blob/main/C-03-SQLi-Single-Item-ID_en.md)
- [https://itsourcecode.com/](https://itsourcecode.com/)

## Related threats

- [itsourcecode Online Medicine Delivery System unrestricted file upload in order management](https://junglewise.ai/threats/cve-2026-85208-itsourcecode-online-medicine-delivery-system-unrestricted-file)
- [itsourcecode Online Medicine Delivery System reflected XSS in orderdetails](https://junglewise.ai/threats/cve-2026-85207-itsourcecode-online-medicine-delivery-system-reflected-xss-in)
- [itsourcecode Online Medicine Delivery System SQL injection in addwishlist](https://junglewise.ai/threats/cve-2026-85205-itsourcecode-online-medicine-delivery-system-sql-injection-in)
- [itsourcecode Online Medicine Delivery System SQL injection in order status update](https://junglewise.ai/threats/cve-2026-85187-itsourcecode-online-medicine-delivery-system-sql-injection-in)
- [itsourcecode Online Medicine Delivery System unrestricted file upload](https://junglewise.ai/threats/cve-2026-85186-itsourcecode-online-medicine-delivery-system-unrestricted-file)