Is CVE-2026-85187 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85187 being exploited in the wild.

How severe is CVE-2026-85187?

High severity, with a CVSS score of 7.3, published 3 September 2026.

Which products and versions are affected?

Itsourcecode Online Medicine Delivery System 1.0.

Is there a fix for CVE-2026-85187?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85187 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-85187?

Check whether you run Itsourcecode Online Medicine Delivery System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85187: itsourcecode Online Medicine Delivery System SQL injection in order status update

CVE-2026-85187 · Severity: high · CVSS 7.3 · Published 2026-09-03

itsourcecode Online Medicine Delivery System is an open-source PHP application for managing medicine orders and delivery. The system contains a SQL injection vulnerability in the order management interface that allows attackers with admin access (or those who exploit a separate authentication bypass) to extract sensitive customer data, modify order records, or trigger spam messages. This vulnerability can lead to unauthorized access to customer phone numbers, addresses, and payment information.

Technologies: Itsourcecode Online Medicine Delivery System. Vendors: Itsourcecode.

Quick answers

Is CVE-2026-85187 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85187 being exploited in the wild.
How severe is CVE-2026-85187?: High severity, with a CVSS score of 7.3, published 3 September 2026.
Which products and versions are affected?: Itsourcecode Online Medicine Delivery System 1.0.
Is there a fix for CVE-2026-85187?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85187 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-85187?: Check whether you run Itsourcecode Online Medicine Delivery System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in /rider/orders/controller.php where the $_GET['id'] parameter is directly concatenated into four SQL statements (two UPDATE queries via Order::pupdate() and Summary::update(), and two SELECT queries) without parameterized queries or sanitization. The 'id' parameter is numeric-type and can be injected without quote escaping. While the endpoint requires an admin session, the attack can be combined with a separate employee authentication bypass vulnerability to gain unauthenticated admin access. An attacker can exploit this via boolean-blind, error-based, or time-based SQL injection techniques to extract arbitrary database records, modify order statuses and amounts, or construct malicious SMS messages.

Affected products

itsourcecode Online Medicine Delivery System 1.0

Timeline

2026-09-03: disclosed: Publicly disclosed via GitHub
2026-09-03: other: CVE-2026-85187 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.