Executive brief
The Online Medicine Delivery System is a web application that allows patients to order medicines online. A flaw in the customer account photo upload feature permits attackers to upload malicious files such as web shells, leading to complete server compromise and the ability to steal patient data, disrupt service, or use the server for further attacks. While the system requires a login, attackers can bypass authentication using a separate SQL injection vulnerability to gain access without a password.
Technical details
The vulnerability is an authenticated arbitrary file upload in the /customer/controller.php file, specifically in the doupdateimage() function (action=photos) and processorder() function. The doupdateimage() function uses getimagesize() to validate that uploaded files are images, but this check can be bypassed by prepending a valid GIF89a image header to PHP code. The processorder() function has no validation at all and directly moves uploaded files to a web-accessible directory. Both functions preserve the original filename without randomization. An attacker with a customer session can upload a PHP web shell to the customer_image/ or uploaded_images/ directory and execute arbitrary code on the server. The attack is network-accessible and does not require elevated privileges beyond a customer account, which can be obtained by exploiting a companion SQL injection authentication bypass in the same system.
Affected products
- itsourcecode Online Medicine Delivery System 1.0
Timeline
- 2026-09-03: disclosed
- 2026-09-03: advisory: CVE-2026-85186