Description

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is the function Employee::employeeAuthentication of the file /rider/login.php of the component Login Interface. The manipulation of the argument emp_email results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-31T04:17:26.273Z",
  "pubdate": "2026-08-31T04:17:26.273Z",
  "executiveSummary": "The itsourcecode Online Medicine Delivery System version 1.0 contains a critical SQL injection vulnerability within the /rider/login.php file. This flaw is located in the Employee::employeeAuthentication function and is triggered by the improper sanitization of the emp_email input parameter.\nThe vulnerability allows remote, unauthenticated attackers to manipulate SQL queries by injecting malicious SQL commands via the login interface. Successful exploitation grants an attacker the ability to bypass authentication mechanisms, gain unauthorized access to the application, or compromise the backend database.\nGiven that the exploit code is publicly available, this vulnerability poses a severe risk to organizations deploying this software. Attackers can perform unauthorized data exfiltration, modify database records, or potentially gain administrative control over the application. The system lacks sufficient input validation and parameterized query implementation, making it highly susceptible to exploitation over the network.",
  "technicalDetails": "The vulnerability originates from the insecure handling of user-supplied data within the /rider/login.php component of the Online Medicine Delivery System 1.0. Specifically, the Employee::employeeAuthentication function fails to perform adequate input validation or sanitization on the emp_email argument before incorporating it into a database query.\nIn a standard SQL injection scenario within this application, the application constructs a dynamic SQL statement by concatenating the unvalidated input directly into the command string. By providing a crafted payload in the emp_email field, an attacker can manipulate the query logic. For example, injecting characters such as single quotes ('), comment sequences (-- or #), or logical operators (OR 1=1) allows the attacker to alter the intended structure of the query executed by the database management system.\nThe attack flow proceeds as follows: First, the attacker identifies the /rider/login.php endpoint as the entry point. Second, the attacker submits a malicious request containing an injected SQL string through the emp_email parameter. Third, the backend server processes this input within the Employee::employeeAuthentication function without implementing parameterized queries or prepared statements. Fourth, the database executes the altered SQL statement, effectively bypassing authentication checks or returning data that the attacker is not authorized to access.\nBecause this component is part of the rider login interface, it is directly exposed to the internet. No authentication is required to initiate the attack, as the injection occurs at the point of authentication itself. The impact of such a flaw is extensive; beyond authentication bypass, an attacker can leverage UNION-based SQL injection techniques to extract sensitive information from other tables within the database, potentially leading to a complete compromise of the underlying data. As public exploit scripts exist for this vulnerability, the barrier to entry for potential adversaries is minimal."
}