Online Medicine Delivery CVE-2026-82612

The endpoint /index.php?q=single-item must be reachable over the network - no authentication is required (CVSS PR:N, UI:N). No special server configuration or non-default settings are needed; any default deployment of Online Medicine Delivery System 1.0 with the Product Detail Page publicly accessible is vulnerable. Exploitation scope is bounded by the database account's privileges: if the application DB user is restricted to SELECT on specific tables, INSERT/UPDATE/DELETE-based attacks will fail. Stacked queries and file-read/write primitives (e.g., INTO OUTFILE) depend on MySQL configuration and user grants, which vary by deployment.

The CVSS 4.0 score of 6.9 reflects a network-accessible, zero-authentication, low-complexity attack path with moderate impact across confidentiality, integrity, and availability on the vulnerable system. The E:P (exploit public) modifier in the vector is significant: a working proof-of-concept is hosted on GitHub, enabling script-level replication by low-skill threat actors. No EPSS score was supplied, and the CVE is not in CISA KEV, so confirmed mass exploitation cannot be stated - however, even a mid-sized municipal IT team in olsztyn running this software should treat this as urgent given the frictionless remote attack surface and availability of exploit code. The CVSS impact metrics (VC:L/VI:L/VA:L) suggest per-query impact is limited, but chained SQL injection techniques - UNION-based enumeration, stacked queries if permitted by the DB driver - can escalate beyond what the score implies. There are no conflicting signals in the available data; the network vector and public POC are consistent.

An unauthenticated attacker sends a crafted HTTP request to /index.php?q=single-item with an ID value containing SQL injection syntax - for example, appending ' OR 1=1-- or a UNION-based payload. The loadResultList function passes this unsanitized string directly to the database, returning data from arbitrary tables. The publicly available GitHub POC at https://github.com/boyslikesports/202607_vul_dir/blob/main/C-03-SQLi-Single-Item-ID_en.md documents the precise payload format, enabling replication with minimal technical skill.