Executive brief
itsourcecode Online Medicine Delivery System is an open-source PHP application for managing medicine orders and delivery. The system contains a SQL injection vulnerability in the order management interface that allows attackers with admin access (or those who exploit a separate authentication bypass) to extract sensitive customer data, modify order records, or trigger spam messages. This vulnerability can lead to unauthorized access to customer phone numbers, addresses, and payment information.
Technical details
A SQL injection vulnerability exists in /rider/orders/controller.php where the $_GET['id'] parameter is directly concatenated into four SQL statements (two UPDATE queries via Order::pupdate() and Summary::update(), and two SELECT queries) without parameterized queries or sanitization. The 'id' parameter is numeric-type and can be injected without quote escaping. While the endpoint requires an admin session, the attack can be combined with a separate employee authentication bypass vulnerability to gain unauthenticated admin access. An attacker can exploit this via boolean-blind, error-based, or time-based SQL injection techniques to extract arbitrary database records, modify order statuses and amounts, or construct malicious SMS messages.
Affected products
- itsourcecode Online Medicine Delivery System 1.0
Timeline
- 2026-09-03: disclosed: Publicly disclosed via GitHub
- 2026-09-03: other: CVE-2026-85187 assigned