Executive brief
The Online Medicine Delivery System is a PHP-based web application used by pharmacies and healthcare providers to manage medication orders online. A reflected cross-site scripting (XSS) vulnerability in the order details page allows an authenticated customer to inject malicious JavaScript code that executes in other users' browsers, potentially stealing session cookies, hijacking accounts, or stealing login credentials through fake login forms.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in the /index.php?q=orderdetails page that fails to sanitize the POST parameter 'location' before outputting it to HTML. The vulnerable code echoes the location parameter directly into three HTML contexts without using htmlspecialchars() or htmlentities() encoding: inside a span tag for delivery fee display, within an input hidden field value attribute, and in an arithmetic calculation for overall price. The attack requires an authenticated customer session and can be delivered via a crafted POST request. An attacker can inject JavaScript code that will execute in the victim's browser, enabling cookie theft, session hijacking, or phishing attacks. The vendor has published remediation guidance recommending output encoding using htmlspecialchars() and input validation for numeric values.
Affected products
- itsourcecode Online Medicine Delivery System 1.0
Timeline
- 2026-09-03: disclosed