Description

A vulnerability has been found in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function Customer::find_phone of the file /passwordrecover.php of the component Password Recovery Interface. The manipulation of the argument phonenumber leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-31T05:17:06.217Z",
  "pubdate": "2026-08-31T05:17:06.217Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the itsourcecode Online Medicine Delivery System 1.0 within the password recovery functionality.\nThe flaw originates from improper sanitization of user-supplied input in the phonenumber parameter within the Customer::find_phone function located in /passwordrecover.php.\nThis vulnerability allows remote, unauthenticated attackers to execute arbitrary SQL commands against the backend database.\nSuccessful exploitation poses a significant security risk, potentially leading to unauthorized data exfiltration, modification of database records, or complete compromise of the application's data layer.\nAs a public exploit exists, the risk is elevated, and immediate remediation is required to prevent unauthorized access and potential administrative account takeover.",
  "technicalDetails": "The vulnerability resides in the /passwordrecover.php file, specifically within the Customer::find_phone function. The application processes user input provided via the phonenumber argument without implementing sufficient parameterization or adequate input validation/escaping mechanisms.\nThis flaw characterizes a classic SQL injection vector where malicious SQL syntax can be injected directly into the backend query structure.\nThe attack flow begins when an attacker sends a crafted HTTP request to the /passwordrecover.php endpoint, substituting the expected phonenumber input with malicious SQL payload sequences.\nBecause the function fails to treat the input as a literal string, the database management system interprets the injected characters as executable commands rather than data.\nThe lack of prepared statements or parameterized queries allows the attacker to manipulate the query logic, which may facilitate bypasses of authentication logic, UNION-based extraction of database schemas, or blind SQL injection techniques to infer sensitive information such as credentials or personal user data.\nExploitation does not require prior authentication or elevated privileges, as the vulnerable function is part of the password recovery interface, which is typically exposed to unauthenticated users.\nThe vulnerability is remotely exploitable over the network, making it a critical threat to any instance of the Online Medicine Delivery System 1.0.\nPost-exploitation, an attacker can gain unauthorized access to the underlying database, leading to potential complete data loss or service disruption.\nBy manipulating the SQL context, an adversary can effectively bypass the intended business logic of the 'find_phone' lookup, leading to account enumeration or unauthorized password resets if the application logic relies solely on this function to verify customer identity."
}