A flaw has been found in itsourcecode Online Medicine Delivery System 1.0. This vulnerability affects the function loadResultList of the file /index.php?q=product of the component Product Category Filter Interface. Executing a manipulation of the argument Category can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.

A SQL injection vulnerability (CVE-2026-82614) has been identified in itsourcecode Online Medicine Delivery System version 1.0. The flaw resides in the loadResultList function within the Product Category Filter Interface, accessible via /index.php?q=product. Attackers can manipulate the 'Category' argument to inject malicious SQL queries. The attack can be launched remotely without requiring physical access. A working exploit has been publicly published, increasing the risk of active exploitation. The vulnerability poses a significant risk to any organization running this software as it could lead to unauthorized database access or data exfiltration. No patch information is currently noted in the article.