CVE-2026-82615

Name of the Vulnerable Software and Affected Versions itsourcecode Online Medicine Delivery System version 1.0

Description An issue exists in the Password Recovery Interface component within the /passwordrecover.php file. The Customer::find phone() function fails to properly handle the phonenumber argument, allowing for remote SQL injection. SQL injection is a technique where an attacker inserts malicious SQL code into a query, potentially allowing them to manipulate the database.

Recommendations Update itsourcecode Online Medicine Delivery System version 1.0 to a patched version. As a temporary mitigation, restrict access to the /passwordrecover.php file or avoid using the phonenumber argument until a fix is applied.