Executive brief
The Online Medicine Delivery System is a PHP application used to manage and sell medicines online. An attacker can exploit a flaw in the product search feature to inject malicious SQL commands and extract sensitive data from the entire database, including customer passwords, personal information, and order history, without needing to log in.
Technical details
This is a classic SQL injection vulnerability in the product search interface (/index.php?q=product) affecting the loadResultList() function in menu.php. The search parameter is concatenated directly into LIKE SQL queries without input validation or prepared statements. An unauthenticated attacker can manipulate the search POST parameter to break out of the LIKE clause (by closing the '%' and single quote) and append arbitrary SQL—supporting UNION-based, error-based, time-based blind, and boolean-based injection techniques. The vulnerability allows full database disclosure including user credentials and customer data. No patch is currently available; remediation requires parameterized queries and input validation.
Affected products
- itsourcecode Online Medicine Delivery System 1.0
Timeline
- 2026-08-31: disclosed
- 2026-08-31: other: Exploit is public and actively used in the wild