# CVE-2026-85187: itsourcecode Online Medicine Delivery System SQL injection in order status update

Source: https://junglewise.ai/threats/cve-2026-85187-itsourcecode-online-medicine-delivery-system-sql-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-85187 · Severity: high · CVSS 7.3 · Published 2026-09-03

itsourcecode Online Medicine Delivery System is an open-source PHP application for managing medicine orders and delivery. The system contains a SQL injection vulnerability in the order management interface that allows attackers with admin access (or those who exploit a separate authentication bypass) to extract sensitive customer data, modify order records, or trigger spam messages. This vulnerability can lead to unauthorized access to customer phone numbers, addresses, and payment information.

Technologies: [Itsourcecode Online Medicine Delivery System](https://junglewise.ai/threats/technologies/online-medicine-delivery-system). Vendors: [Itsourcecode](https://junglewise.ai/threats/vendors/itsourcecode).

## Quick answers

**Is CVE-2026-85187 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85187 being exploited in the wild.

**How severe is CVE-2026-85187?** High severity, with a CVSS score of 7.3, published 3 September 2026.

**Which products and versions are affected?** Itsourcecode Online Medicine Delivery System 1.0.

**Is there a fix for CVE-2026-85187?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85187 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-85187?** Check whether you run Itsourcecode Online Medicine Delivery System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in /rider/orders/controller.php where the $_GET['id'] parameter is directly concatenated into four SQL statements (two UPDATE queries via Order::pupdate() and Summary::update(), and two SELECT queries) without parameterized queries or sanitization. The 'id' parameter is numeric-type and can be injected without quote escaping. While the endpoint requires an admin session, the attack can be combined with a separate employee authentication bypass vulnerability to gain unauthenticated admin access. An attacker can exploit this via boolean-blind, error-based, or time-based SQL injection techniques to extract arbitrary database records, modify order statuses and amounts, or construct malicious SMS messages.

## Affected products

- itsourcecode Online Medicine Delivery System 1.0

## Timeline

- 2026-09-03: disclosed: Publicly disclosed via GitHub
- 2026-09-03: other: CVE-2026-85187 assigned

## References

- [https://github.com/boyslikesports/202607_vul_dir/blob/main/C-12-SQLi-Rider-Order-MultiPoint_en.md](https://github.com/boyslikesports/202607_vul_dir/blob/main/C-12-SQLi-Rider-Order-MultiPoint_en.md)
- [https://itsourcecode.com/](https://itsourcecode.com/)

## Related threats

- [itsourcecode Online Medicine Delivery System unrestricted file upload in order management](https://junglewise.ai/threats/cve-2026-85208-itsourcecode-online-medicine-delivery-system-unrestricted-file)
- [itsourcecode Online Medicine Delivery System reflected XSS in orderdetails](https://junglewise.ai/threats/cve-2026-85207-itsourcecode-online-medicine-delivery-system-reflected-xss-in)
- [itsourcecode Online Medicine Delivery System SQL injection in addwishlist](https://junglewise.ai/threats/cve-2026-85205-itsourcecode-online-medicine-delivery-system-sql-injection-in)
- [itsourcecode Online Medicine Delivery System unrestricted file upload](https://junglewise.ai/threats/cve-2026-85186-itsourcecode-online-medicine-delivery-system-unrestricted-file)
- [itsourcecode Online Medicine Delivery System SQL injection in password recovery](https://junglewise.ai/threats/cve-2026-82615-itsourcecode-online-medicine-delivery-system-sql-injection-in)