Online Medicine Delivery System CVE-2026-82613

No special conditions are required for exploitation. The vulnerable endpoint /index.php?q=product is reachable over the network without authentication, and the Search argument is processed without sanitization regardless of application configuration. Exploitation is limited by the following factors: the product must be internet- or network-accessible (not installed but never deployed); the target must be running itsourcecode Online Medicine Delivery System 1.0 specifically; and the severity of data exposure depends on the database account's privileges - a least-privilege configuration would restrict what data an attacker can read or modify. No specific operating system, PHP version, or non-default configuration is required to trigger the vulnerability.

The CVSS 4.0 score of 5.5 (Medium) reflects limited CIA impact (VC:L/VI:L/VA:L) against no authentication barrier whatsoever (PR:N/UI:N/AC:L). The E:P modifier confirms proof-of-concept code is public, which meaningfully lowers the skill threshold for exploitation. Despite these accessible exploitation conditions, real-world risk is substantially reduced by the product's deployment profile: itsourcecode projects are academic demonstration codebases rarely deployed in production with sensitive data. The absence of a KEV listing and the niche nature of the product suggest exploitation, if it occurs, would be opportunistic and low-scale. EPSS data was not provided, but given the obscurity of the product, a low EPSS score would be consistent with the overall picture. The primary genuine risk exists for any academic institution or developer who mistakenly deployed this system in a production context with real patient or order data.

An unauthenticated remote attacker sends a crafted HTTP GET request to /index.php?q=product with a SQL payload injected into the Search parameter (e.g., ' OR '1'='1' UNION SELECT ...), triggering unsanitized query execution inside loadResultList. The public PoC on GitHub documents the injection point, meaning a low-skill attacker can replicate the attack with minimal modification. Depending on database privileges, the attacker can enumerate table structures, extract stored user or order data, or modify records.