Description

A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-03T20:17:27.613Z",
  "pubdate": "2026-09-03T20:17:27.613Z",
  "executiveSummary": "A Reflected Cross-Site Scripting (XSS) vulnerability exists in the itsourcecode Online Medicine Delivery System version 1.0.\nThe vulnerability resides within the 'location' parameter of the '/index.php?q=orderdetails' endpoint, which fails to properly sanitize user-supplied input before rendering it in the browser.\nThis flaw allows remote, unauthenticated attackers to execute arbitrary JavaScript within the context of a victim's session, potentially leading to unauthorized actions, session hijacking, or the theft of sensitive data.\nThe vulnerability is currently subject to publicly available exploit code, increasing the likelihood of exploitation by malicious actors.\nGiven that the application is designed to handle sensitive health-related data, the impact of a successful XSS attack is significant, as it could compromise customer accounts and personal identifiable information (PII).\nRemediation requires the implementation of robust input validation and context-aware output encoding to neutralize malicious scripts injected via URL parameters.",
  "technicalDetails": "The vulnerability is a classic case of Reflected Cross-Site Scripting (XSS) occurring at the application layer. The root cause is the improper handling of the 'location' parameter within the '/index.php?q=orderdetails' script. The application receives this parameter via an HTTP GET request and subsequently reflects the value back into the HTML response without performing adequate input validation or contextual output encoding.\nThe attack flow begins when an attacker crafts a malicious URL containing a JavaScript payload within the 'location' argument. For instance, an attacker could manipulate the URL to include <script>alert(document.cookie)</script> or other more sophisticated payloads designed for data exfiltration or session manipulation. When an authenticated user, such as an administrator or a customer, clicks on this crafted link, the victim's web browser processes the malicious input as part of the page structure.\nBecause the server does not encode special characters like '<', '>', and '\"' in the 'location' value, the browser interprets the injected string as executable code rather than plain text. This allows the attacker to execute arbitrary scripts in the security context of the origin (the domain hosting the Online Medicine Delivery System).\nThe exploit can be launched remotely without requiring prior authentication or specific system privileges. The attack is effective as long as the victim visits the manipulated URL while having an active session with the application. The post-exploitation impact includes, but is not limited to, the hijacking of administrative or user session cookies, the modification of the DOM to present fraudulent content to the user, and the silent exfiltration of PII associated with the user's account.\nThis vulnerability is particularly critical due to the presence of publicly available exploit code, which lowers the barrier to entry for attackers. The lack of Content Security Policy (CSP) implementation further exacerbates the risk, as it allows the execution of unauthorized inline scripts that would otherwise be blocked by modern browser security mechanisms."
}