An unauthenticated SQL injection vulnerability in the itsourcecode Online Medicine Delivery System 1.0 poses a critical risk of full database compromise.

The application fails to sanitize the search parameter within the loadResultList function in /index.php?q=product, allowing an unauthenticated attacker to inject malicious SQL commands into a LIKE query.

Successful exploitation allows an attacker to bypass authentication and extract sensitive information from the database, including customer personal data, administrative credentials, and order history. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially leading to severe reputational damage and regulatory non-compliance.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected search interface via network-level controls or by disabling the search feature entirely until a secure version is released.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests to /index.php?q=product containing SQL syntax characters such as single quotes, parentheses, or UNION keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the search parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the referenced GitHub security write-up.

The presence of a public proof-of-concept for this SQL injection vulnerability necessitates immediate defensive action. Because the flaw allows for unauthenticated data extraction, prioritize isolating the affected system from public-facing networks until the vendor provides a remediation or the source code is hardened using parameterized queries.