The itsourcecode Online Medicine Delivery System 1.0 contains an unauthenticated SQL injection vulnerability that poses a critical risk of full database data disclosure.

This vulnerability is a SQL injection flaw in the product category filter interface, specifically within the loadResultList function. An unauthenticated attacker can manipulate the category parameter in the index.php script to inject malicious SQL commands, as the input is concatenated directly into database queries without sanitization.

The ability to perform unauthorized SQL queries enables an attacker to extract sensitive information from the backend database, including user credentials, customer personal data, and order history. Given the CVSS score of 7.3, this flaw represents a significant risk of data breach and compromise of the entire application database, potentially leading to severe regulatory and reputational damage.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the affected frontend interface or implement strict input validation on the category parameter to ensure it matches expected alphanumeric values.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous GET requests containing SQL syntax, such as UNION, SELECT, or SLEEP commands, directed at the index.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns and filter malicious payloads targeting the category parameter.

Public Exploit Available: Yes, a functional proof of concept and detailed technical write-up are available via the GitHub repository maintained by the security researcher who identified the flaw.

The vulnerability in the itsourcecode Online Medicine Delivery System 1.0 is severe due to the ease with which an unauthenticated attacker can exfiltrate the entire contents of the database. Organizations currently hosting this software must prioritize implementing the suggested WAF rules and input validation immediately, as the public availability of exploit code significantly lowers the barrier for malicious actors to conduct successful attacks.