Executive brief
The itsourcecode Online Medicine Delivery System is a web application used to manage and sell pharmaceuticals online. An attacker can inject malicious SQL commands through the product category filter without authentication, allowing unauthorized access to sensitive database information including customer data, passwords, and medical records. This vulnerability exposes the entire customer base and business operations to data theft.
Technical details
A SQL injection vulnerability exists in the product category filter interface (/index.php?q=product) within the loadResultList() function of menu.php. The vulnerable code concatenates unsanitized user input from the Category parameter directly into a SQL WHERE clause without any validation or parameterized queries. An unauthenticated attacker can exploit this via UNION-based, error-based, or time-based blind SQL injection techniques to extract arbitrary data from the database, including user credentials, order information, and medical records. The vulnerability is publicly disclosed with working proof-of-concept exploits available, and patches should be applied immediately by implementing parameterized queries and input validation.
Affected products
- itsourcecode Online Medicine Delivery System 1.0
Timeline
- 2026-08-31: disclosed
- other: Exploit published and publicly available