A critical SQL injection vulnerability in the itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to bypass security controls and exfiltrate sensitive data from the backend database.

The application fails to sanitize the id parameter within the loadResultList function on the product detail page, which is processed via /index.php?q=single-item. This flaw permits unauthenticated attackers to inject malicious SQL commands directly into database queries, supporting UNION, error-based, and blind injection techniques.

The vulnerability poses a severe risk to data confidentiality and integrity. An attacker can leverage this flaw to perform full database exfiltration, potentially exposing customer personal information, user credentials, and order history. Given the CVSS score of 7.3, this represents a high-severity threat that could lead to significant reputational damage and regulatory non-compliance.

Immediate Action: As no official patch is currently available, administrators should restrict public access to the affected product detail pages or implement strict input validation to ensure the id parameter is restricted to integer values only.

Proactive Monitoring: Review web server access logs for anomalous GET requests containing SQL syntax, such as UNION, SELECT, or SLEEP commands, directed at the index.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in URL parameters to mitigate the risk of exploitation.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the researcher's technical write-up.

This vulnerability is highly dangerous due to the lack of required authentication and the ease with which sensitive data can be retrieved. Administrators must treat this as a priority, implementing WAF protections immediately while monitoring for signs of unauthorized database access. Since no vendor patch is currently available, organizations should consider disabling the affected component if it is not business-critical.