Description

A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function Customer::cusAuthentication of the file /login.php of the component Customer Login Interface. This manipulation of the argument U_USERNAME causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-31T04:17:28.317Z",
  "pubdate": "2026-08-31T04:17:28.317Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in the itsourcecode Online Medicine Delivery System version 1.0, specifically within the Customer Login Interface.\nThe vulnerability is located in the Customer::cusAuthentication function within /login.php and is triggered by improper sanitization of the U_USERNAME parameter.\nThis flaw allows remote, unauthenticated attackers to execute arbitrary SQL commands against the backend database, potentially leading to unauthorized data exfiltration, authentication bypass, or full compromise of the application's data layer.\nGiven that proof-of-concept exploits are publicly available, the risk to deployments is high.\nThe exploitation does not require prior authentication, making it a significant threat to system confidentiality and integrity.",
  "technicalDetails": "The vulnerability stems from the application's failure to adequately validate or parameterize user-supplied input before incorporating it into dynamic SQL queries.\nThe root cause is identified within the /login.php file, where the Customer::cusAuthentication function processes the U_USERNAME argument. The application takes the raw input from the HTTP request and concatenates it directly into a database query string used for user authentication verification.\nBy injecting malicious SQL syntax—such as quotes, comment markers, or logical operators (e.g., ' OR '1'='1)—into the U_USERNAME field, an attacker can manipulate the query logic. This allows the adversary to bypass the authentication mechanism entirely or extract data from the database by leveraging UNION-based or error-based SQL injection techniques.\nThe attack flow follows these steps: (1) An attacker targets the /login.php endpoint via a remote network connection; (2) The attacker submits a specially crafted string containing SQL payload sequences to the U_USERNAME parameter; (3) The vulnerable Customer::cusAuthentication function executes the resulting query without parameterized queries or adequate input filtering; (4) The backend database server parses and executes the injected malicious instructions, returning results that the application may expose to the user or utilize to alter access control decisions.\nAs the exploit is remote and requires no privilege level, it poses a critical threat to the database infrastructure connected to the Online Medicine Delivery System 1.0. Successful exploitation allows for the dumping of sensitive customer records, credential harvesting, or administrative account takeover depending on the database's configured permissions and the structure of the backend schema."
}