# CVE-2026-82613: itsourcecode Online Medicine Delivery System SQL injection in product search

Source: https://junglewise.ai/threats/cve-2026-82613-itsourcecode-online-medicine-delivery-system-sql-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82613 · Severity: high · CVSS 7.3 · Published 2026-08-31

The Online Medicine Delivery System is a PHP application used to manage and sell medicines online. An attacker can exploit a flaw in the product search feature to inject malicious SQL commands and extract sensitive data from the entire database, including customer passwords, personal information, and order history, without needing to log in.

Technologies: [Itsourcecode Online Medicine Delivery System](https://junglewise.ai/threats/technologies/online-medicine-delivery-system). Vendors: [Itsourcecode](https://junglewise.ai/threats/vendors/itsourcecode).

## Quick answers

**Is CVE-2026-82613 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82613 being exploited in the wild.

**How severe is CVE-2026-82613?** High severity, with a CVSS score of 7.3, published 31 August 2026.

**Which products and versions are affected?** Itsourcecode Online Medicine Delivery System 1.0.

**Is there a fix for CVE-2026-82613?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82613 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-82613?** Check whether you run Itsourcecode Online Medicine Delivery System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a classic SQL injection vulnerability in the product search interface (/index.php?q=product) affecting the loadResultList() function in menu.php. The search parameter is concatenated directly into LIKE SQL queries without input validation or prepared statements. An unauthenticated attacker can manipulate the search POST parameter to break out of the LIKE clause (by closing the '%' and single quote) and append arbitrary SQL—supporting UNION-based, error-based, time-based blind, and boolean-based injection techniques. The vulnerability allows full database disclosure including user credentials and customer data. No patch is currently available; remediation requires parameterized queries and input validation.

## Affected products

- itsourcecode Online Medicine Delivery System 1.0

## Timeline

- 2026-08-31: disclosed
- 2026-08-31: other: Exploit is public and actively used in the wild

## References

- [https://github.com/boyslikesports/202607_vul_dir/blob/main/C-04-SQLi-Product-Search-LIKE_en.md](https://github.com/boyslikesports/202607_vul_dir/blob/main/C-04-SQLi-Product-Search-LIKE_en.md)
- [https://itsourcecode.com/](https://itsourcecode.com/)

## Related threats

- [itsourcecode Online Medicine Delivery System unrestricted file upload in order management](https://junglewise.ai/threats/cve-2026-85208-itsourcecode-online-medicine-delivery-system-unrestricted-file)
- [itsourcecode Online Medicine Delivery System reflected XSS in orderdetails](https://junglewise.ai/threats/cve-2026-85207-itsourcecode-online-medicine-delivery-system-reflected-xss-in)
- [itsourcecode Online Medicine Delivery System SQL injection in addwishlist](https://junglewise.ai/threats/cve-2026-85205-itsourcecode-online-medicine-delivery-system-sql-injection-in)
- [itsourcecode Online Medicine Delivery System SQL injection in order status update](https://junglewise.ai/threats/cve-2026-85187-itsourcecode-online-medicine-delivery-system-sql-injection-in)
- [itsourcecode Online Medicine Delivery System unrestricted file upload](https://junglewise.ai/threats/cve-2026-85186-itsourcecode-online-medicine-delivery-system-unrestricted-file)