# CVE-2026-82614: itsourcecode Online Medicine Delivery System SQL injection in product category filter

Source: https://junglewise.ai/threats/cve-2026-82614-itsourcecode-online-medicine-delivery-system-sql-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82614 · Severity: high · CVSS 7.3 · Published 2026-08-31

The itsourcecode Online Medicine Delivery System is a web application used to manage and sell pharmaceuticals online. An attacker can inject malicious SQL commands through the product category filter without authentication, allowing unauthorized access to sensitive database information including customer data, passwords, and medical records. This vulnerability exposes the entire customer base and business operations to data theft.

Technologies: [Itsourcecode Online Medicine Delivery System](https://junglewise.ai/threats/technologies/online-medicine-delivery-system). Vendors: [Itsourcecode](https://junglewise.ai/threats/vendors/itsourcecode).

## Quick answers

**Is CVE-2026-82614 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82614 being exploited in the wild.

**How severe is CVE-2026-82614?** High severity, with a CVSS score of 7.3, published 31 August 2026.

**Which products and versions are affected?** Itsourcecode Online Medicine Delivery System 1.0.

**Is there a fix for CVE-2026-82614?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82614 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-82614?** Check whether you run Itsourcecode Online Medicine Delivery System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the product category filter interface (/index.php?q=product) within the loadResultList() function of menu.php. The vulnerable code concatenates unsanitized user input from the Category parameter directly into a SQL WHERE clause without any validation or parameterized queries. An unauthenticated attacker can exploit this via UNION-based, error-based, or time-based blind SQL injection techniques to extract arbitrary data from the database, including user credentials, order information, and medical records. The vulnerability is publicly disclosed with working proof-of-concept exploits available, and patches should be applied immediately by implementing parameterized queries and input validation.

## Affected products

- itsourcecode Online Medicine Delivery System 1.0

## Timeline

- 2026-08-31: disclosed
- other: Exploit published and publicly available

## References

- [https://github.com/boyslikesports/202607_vul_dir/blob/main/C-05-SQLi-Product-Category_en.md](https://github.com/boyslikesports/202607_vul_dir/blob/main/C-05-SQLi-Product-Category_en.md)
- [https://itsourcecode.com/](https://itsourcecode.com/)

## Related threats

- [itsourcecode Online Medicine Delivery System unrestricted file upload in order management](https://junglewise.ai/threats/cve-2026-85208-itsourcecode-online-medicine-delivery-system-unrestricted-file)
- [itsourcecode Online Medicine Delivery System reflected XSS in orderdetails](https://junglewise.ai/threats/cve-2026-85207-itsourcecode-online-medicine-delivery-system-reflected-xss-in)
- [itsourcecode Online Medicine Delivery System SQL injection in addwishlist](https://junglewise.ai/threats/cve-2026-85205-itsourcecode-online-medicine-delivery-system-sql-injection-in)
- [itsourcecode Online Medicine Delivery System SQL injection in order status update](https://junglewise.ai/threats/cve-2026-85187-itsourcecode-online-medicine-delivery-system-sql-injection-in)
- [itsourcecode Online Medicine Delivery System unrestricted file upload](https://junglewise.ai/threats/cve-2026-85186-itsourcecode-online-medicine-delivery-system-unrestricted-file)