Executive brief
itsourcecode Online Medicine Delivery System is a PHP-based platform for managing online medicine orders and customer accounts. An attacker can bypass customer authentication by injecting malicious SQL into the login form, gaining unauthorized access to any customer account without knowing their password. Once inside, attackers can place fraudulent orders, steal personal information, modify customer data, and tamper with account settings.
Technical details
The vulnerability is a SQL injection flaw in the Customer::cusAuthentication() method (include/customers.php) triggered via the U_USERNAME parameter in /login.php. User input is concatenated directly into an SQL WHERE clause without parameterization or input validation, allowing attackers to craft payloads (e.g., ' OR 1=1-- -) that bypass password checks. The attack requires no authentication and is remotely exploitable via POST requests. Both the sidebarLogin and modalLogin code branches are affected. Attackers can achieve Boolean-based and time-based SQL injection to enumerate data or extract credentials. Remediation requires parameterized queries and strict input validation.
Affected products
- itsourcecode Online Medicine Delivery System 1.0
Timeline
- 2026-08-31: disclosed