VYPR
Published Aug 31, 2026· 1 source

Itsourcecode: 13 SQLi Flaws Across Two Systems Disclosed in Late August 2026

Key findings • Six high-severity SQL injection vulnerabilities disclosed for Itsourcecode Online Medicine Delivery System 1.0 on August 31, 2026. • Seven medium-severity SQL injection vulnera…

Key findings

  • Six high-severity SQL injection vulnerabilities disclosed for Itsourcecode Online Medicine Delivery System 1.0 on August 31, 2026.
  • Seven medium-severity SQL injection vulnerabilities disclosed for Itsourcecode Sales and Inventory System 1.0 between August 29-30, 2026.
  • All vulnerabilities across both systems stem from argument manipulation leading to SQL injection.
  • Publicly available exploits exist for the Sales and Inventory System vulnerabilities, increasing immediate risk.
  • No specific patch information released by Itsourcecode; users advised to seek vendor advisories.

On August 31, 2026, a batch of six high-severity SQL injection vulnerabilities was disclosed for the Itsourcecode Online Medicine Delivery System 1.0. These vulnerabilities, all stemming from the manipulation of specific arguments in various PHP files, allow for remote attacks. The disclosures occurred on August 31, 2026, with a prior batch of medium-severity SQL injection vulnerabilities affecting the Itsourcecode Sales and Inventory System 1.0 disclosed on August 29-30, 2026.

The vulnerabilities in the Online Medicine Delivery System 1.0 are concentrated in several components:

  • Password Recovery Interface: CVE-2026-82615 targets the Customer::find_phone function in /passwordrecover.php, allowing SQL injection through the phonenumber argument.
  • Product Category Filter Interface: CVE-2026-82614 affects the loadResultList function in /index.php?q=product, where manipulation of the Category argument leads to SQL injection.
  • Product Search Interface: Similarly, CVE-2026-82613 impacts the loadResultList function in /index.php?q=product, with SQL injection resulting from manipulation of the Search argument.
  • Product Detail Page: CVE-2026-82612 targets the loadResultList function in /index.php?q=single-item, where manipulation of the ID argument leads to SQL injection.
  • Customer Login Interface: CVE-2026-82611 affects the Customer::cusAuthentication function in /login.php, with SQL injection caused by manipulation of the U_USERNAME argument.
  • Login Interface (Rider): CVE-2026-82610 impacts the Employee::employeeAuthentication function in /rider/login.php, where manipulation of the emp_email argument results in SQL injection.

Separately, a batch of seven medium-severity SQL injection vulnerabilities was disclosed for the Itsourcecode Sales and Inventory System 1.0 between August 29 and August 30, 2026. These vulnerabilities, all rated with a CVSSv3 score of 6.3, are triggered by manipulating the 'ID' argument in various PHP files across different components. Notably, for the Sales and Inventory System, publicly available exploits exist for all disclosed CVEs, and these exploits may be used for attacks. The affected files include /pages/sup_searchfrm.php (CVE-2026-82545), /pages/sup_edit.php (CVE-2026-82541), /pages/cust_searchfrm.php (CVE-2026-82540), /pages/pro_edit.php (CVE-2026-82485), /pages/emp_searchfrm.php (CVE-2026-82484), /pages/emp_del.php (CVE-2026-82422), and /pages/emp_edit.php (CVE-2026-82421).

The vendor, Itsourcecode, has not released specific patch information for these vulnerabilities. Users are advised to consult vendor advisories for the latest updates and mitigation strategies. Given the nature of SQL injection vulnerabilities and the existence of public exploits for some of these issues, prompt patching or mitigation is crucial to prevent unauthorized data access and manipulation.

This coordinated disclosure highlights a significant pattern of SQL injection flaws across multiple Itsourcecode products, emphasizing the need for thorough security audits of web applications, particularly those handling sensitive user or business data. The consistent use of argument manipulation to achieve SQL injection across different system components suggests potential systemic weaknesses in input validation and database query construction within Itsourcecode's development practices.

The batch of vulnerabilities for the Online Medicine Delivery System 1.0, all disclosed on August 31, 2026, presents a critical risk due to their high severity. The Sales and Inventory System vulnerabilities, while medium in severity, are compounded by the availability of public exploits, increasing the immediate threat to organizations using that system.

Users of both the Itsourcecode Online Medicine Delivery System 1.0 and the Sales and Inventory System 1.0 should prioritize addressing these vulnerabilities. The lack of specific patch details necessitates a proactive approach to security, potentially involving manual code reviews or vendor-provided security updates as they become available.

The consistent theme of SQL injection across these disclosures warrants attention from Itsourcecode's development team to implement more robust security measures and prevent future occurrences. The public availability of exploits for the Sales and Inventory System vulnerabilities underscores the urgency for users to take immediate action. ,cve_ids:[

Synthesized by Vypr AI