Description

A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addwishlist of the file /customer/controller.php?action=addwish of the component Wishlist. This manipulation of the argument proid causes sql injection. The attack may be initiated remotely.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-03T19:17:30.230Z",
  "pubdate": "2026-09-03T19:17:30.230Z",
  "executiveSummary": "The itsourcecode Online Medicine Delivery System 1.0 contains a critical SQL injection vulnerability within the Wishlist component.\nThe vulnerability resides in the addwishlist function located in /customer/controller.php, specifically triggered via the proid argument.\nThis flaw allows remote, unauthenticated or authenticated attackers to manipulate database queries by injecting malicious SQL statements.\nSuccessful exploitation grants an attacker the ability to bypass security controls, view sensitive data, modify database contents, or potentially gain administrative access to the underlying database server.\nGiven the nature of the application, which handles sensitive medical and customer data, this vulnerability poses a severe risk to data confidentiality, integrity, and availability.\nThe attack is remotely exploitable, requiring no specific user interaction beyond sending a crafted HTTP request to the vulnerable endpoint.",
  "technicalDetails": "The vulnerability is identified as a classic SQL Injection (SQLi) flaw within the Online Medicine Delivery System 1.0, specifically affecting the Wishlist management functionality.\nThe root cause is the improper neutralization of special elements used in an SQL command in the addwishlist function within /customer/controller.php. The application fails to sanitize or validate the proid (product ID) parameter before incorporating it directly into a dynamic SQL query string.\nWhen a user triggers the addwishlist action, the application processes the proid parameter. If this parameter is not handled via prepared statements or parameterized queries, an attacker can supply malicious input containing SQL syntax characters (e.g., single quotes, comment indicators like -- or #).\nThe attack flow begins when an attacker sends a crafted HTTP request to /customer/controller.php?action=addwish. By injecting arbitrary SQL commands into the proid argument, the attacker can alter the intended logic of the database query.\nFor example, an attacker could append a UNION SELECT statement to extract user credentials, medicine inventory details, or other sensitive information from the database tables. Alternatively, the attacker could use boolean-based or time-based blind SQL injection techniques to infer database structure and content if direct output is suppressed.\nBecause the vulnerable component is reachable remotely, the attack surface is exposed to any network entity that can reach the web server hosting the application. The lack of input validation at the application layer permits this malformed input to reach the database backend where the query is executed with the privileges of the web application user.\nPost-exploitation, an attacker can achieve significant impact, including unauthorized data exfiltration, modification of order statuses, or potentially escalating privileges if the database user has elevated permissions on the host system. This may facilitate further system compromise or data breaches involving protected health or consumer information."
}