Description

A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdateimage of the file /customer/controller.php?action=photos of the component Customer Controller. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-03T17:17:30.007Z",
  "pubdate": "2026-09-03T17:17:30.007Z",
  "executiveSummary": "The itsourcecode Online Medicine Delivery System 1.0 is affected by an Unrestricted File Upload vulnerability within the Customer Controller component.\nThis security weakness resides in the 'doupdateimage' function located in '/customer/controller.php?action=photos', which fails to adequately validate or restrict user-supplied file uploads submitted via the 'photo' argument.\nBy manipulating the 'photo' parameter, an unauthenticated or remote attacker can upload arbitrary files, including malicious scripts, to the application server.\nThe successful exploitation of this vulnerability allows for remote code execution (RCE), potentially leading to complete system compromise, unauthorized data access, and persistent backdoor installation.\nGiven that public exploit code is available, the risk of active exploitation is high. Organizations deploying this software are exposed to significant threats, as the vulnerability does not inherently require complex bypass techniques, allowing attackers to weaponize the file upload mechanism directly to gain server-side control.",
  "technicalDetails": "The vulnerability is classified as an Unrestricted File Upload flaw, stemming from improper input validation within the 'doupdateimage' function in the file '/customer/controller.php'. The application logic fails to enforce robust server-side checks on file extensions, MIME types, or content headers for the 'photo' argument.\nThe attack flow initiates when an attacker sends a crafted HTTP request targeting the '/customer/controller.php' endpoint with the 'action=photos' parameter. By injecting a malicious payload—such as a PHP web shell—into the 'photo' multipart/form-data argument, the attacker circumvents intended file type restrictions.\nUpon submission, the application fails to rename or sanitize the uploaded file effectively, nor does it move the file to a non-executable directory. Consequently, the server writes the attacker-supplied payload into a publicly accessible directory within the web root.\nOnce the file is successfully uploaded, the attacker can execute the code remotely by sending a direct HTTP GET request to the uploaded file's path. This results in the execution of the injected script within the security context of the web server (e.g., www-data or system user).\nPost-exploitation, the attacker achieves arbitrary command execution, which facilitates lateral movement, data exfiltration from the underlying database, and the modification of application logic. Because the vulnerability is remotely exploitable and does not require advanced user privileges in many deployment configurations, the impact is severe. The lack of validation on the 'photo' argument effectively transforms a functional photo update feature into a vector for full system compromise, as the server treats uploaded content as trusted executable code."
}