Executive brief
The Online Medicine Delivery System is a PHP-based application for managing online pharmaceutical sales and deliveries. The password recovery interface contains a SQL injection vulnerability in the phone number parameter that allows attackers to extract sensitive data from the database—including customer personal information and password hashes—without requiring authentication or user interaction.
Technical details
A SQL injection vulnerability exists in the Customer::find_phone() method within /passwordrecover.php, where the phonenumber parameter is directly concatenated into SQL queries without sanitization or parameterized queries. The vulnerability manifests in two places: a SELECT query in the find_phone() method that checks for existing phone numbers, and an INSERT query that stores recovery messages. An unauthenticated attacker can exploit this via time-based blind SQL injection by crafting payloads that cause database delays, allowing character-by-character extraction of arbitrary data. The vulnerability requires no authentication and is directly reachable via HTTP POST to /passwordrecover.php. Remediation involves implementing parameterized queries and strict input validation to accept only numeric phone numbers.
Affected products
- itsourcecode Online Medicine Delivery System 1.0
Timeline
- 2026-08-31: disclosed
- 2026-08-31: advisory