Description

A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the file /rider/orders/controller.php?action=edit&actions=confirm of the component Order Status Update. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-03T18:17:33.707Z",
  "pubdate": "2026-09-03T18:17:33.707Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in the itsourcecode Online Medicine Delivery System 1.0, specifically within the Order Status Update component.\nThe vulnerability resides in the Order::pupdate function, accessible via the /rider/orders/controller.php file.\nBy manipulating the 'ID' parameter during a confirmed order request, a remote, unauthenticated, or authenticated attacker can inject arbitrary SQL commands into the application's backend database.\nSuccessful exploitation allows an attacker to bypass security controls, view sensitive information, modify database records, or potentially gain unauthorized administrative access to the underlying server environment.\nThe risk is high due to the potential for total compromise of the application's data integrity and confidentiality.\nThis vulnerability is publicly disclosed, necessitating immediate attention to prevent exploitation by malicious actors.",
  "technicalDetails": "The vulnerability is a classic SQL Injection (SQLi) flaw located in the Order::pupdate function within the file /rider/orders/controller.php.\nThe root cause is the insecure handling of user-supplied input provided through the 'ID' parameter. The application fails to properly sanitize or parameterize this input before incorporating it into a database query.\nThe attack flow begins when an attacker crafts a malicious request targeting the /rider/orders/controller.php endpoint with the query parameters action=edit and actions=confirm. By supplying a specially crafted SQL payload in the 'ID' argument, the attacker can manipulate the structure of the resulting SQL statement executed by the database engine.\nBecause the input is concatenated directly into the backend query, the application executes the injected code with the privileges of the database user configured for the system.\nThis allows for blind, error-based, or union-based SQL injection, depending on the database configuration and the application's response handling.\nAn attacker can perform reconnaissance by extracting schema information, enumerating table names, and eventually exfiltrating sensitive data such as user credentials, medical records, or session tokens stored within the database.\nFurthermore, depending on the database permissions, an attacker might be able to leverage advanced SQL techniques such as stacked queries or file system access to escalate privileges or gain persistent remote code execution on the host server.\nThe component is reachable over the network, making it accessible for remote exploitation without requiring complex prerequisites beyond the ability to reach the application's interface.\nThe absence of robust input validation or the use of prepared statements (parameterized queries) is the fundamental failure point in this controller's logic.\nThis vulnerability persists in version 1.0 of the Online Medicine Delivery System."
}