Executive brief
itsourcecode's Online Medicine Delivery System is a PHP-based e-commerce application for ordering medicines. The system contains a SQL injection vulnerability in its wishlist feature that allows authenticated users to extract sensitive database information, including customer data and medicine inventory details. An attacker with or without valid credentials can exploit this to bypass authentication and access confidential business and customer information.
Technical details
The vulnerability is a classic SQL injection flaw in the addwishlist() function (action=addwish) within /customer/controller.php, where the proid parameter is directly concatenated into both SELECT and INSERT SQL statements without proper sanitization or parameterized queries. The vulnerable code queries the tblwishlist table and attempts to insert records using unsanitized user input. While the feature requires an authenticated customer session, the same codebase contains an authentication bypass vulnerability that allows obtaining a session without credentials. An attacker can inject time-based blind SQL commands via the proid parameter to enumerate the entire database structure and extract data using tools like sqlmap. Remediation requires implementing parameterized/prepared queries and validating proid as an integer type.
Affected products
- itsourcecode Online Medicine Delivery System 1.0
Timeline
- 2026-09-03: disclosed