Description

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-03T21:17:23.777Z",
  "pubdate": "2026-09-03T21:17:23.777Z",
  "executiveSummary": "A critical unrestricted file upload vulnerability has been identified in the Online Medicine Delivery System 1.0, specifically within the Order Management Controller.\nThe vulnerability resides in the doInsert function located in /rider/orders/controller.php?action=add, where the 'image' argument lacks sufficient server-side validation regarding file type, size, or content.\nThis security flaw allows remote, unauthenticated or authenticated attackers to upload arbitrary files, including malicious scripts such as web shells, directly to the web server.\nSuccessful exploitation facilitates Remote Code Execution (RCE), enabling attackers to compromise the integrity, confidentiality, and availability of the entire host system.\nGiven that proof-of-concept exploit code is publicly available, the risk to affected systems is considered critical, requiring immediate remediation to prevent unauthorized system access and potential data breaches.",
  "technicalDetails": "The vulnerability is rooted in the improper implementation of file upload mechanisms within the doInsert function of the Order Management Controller in /rider/orders/controller.php?action=add.\nThe application fails to perform adequate server-side validation of the 'image' input parameter. Specifically, the system does not enforce strict MIME type checking, file extension blacklisting/whitelisting, or content verification.\nThe attack flow begins with the attacker crafting a malicious HTTP POST request targeting the vulnerable endpoint. By manipulating the multipart/form-data payload, the attacker can upload a file with an executable extension (e.g., .php, .phtml, or .php5).\nOnce the file is uploaded, the web server stores it in a directory accessible to the web server's user. Because the application does not rename the file or sanitize its input metadata, an attacker can determine the file's final location on the server.\nAfter the file is successfully uploaded, the attacker can trigger the execution of the malicious script by navigating to the specific URL where the file resides. If the web server is configured to execute scripts within the upload directory, the attacker achieves arbitrary command execution with the privileges of the web service process (e.g., www-data).\nPost-exploitation, an attacker can leverage this access to perform lateral movement within the network, exfiltrate sensitive database information including medical records or user credentials, modify application logic to facilitate further attacks, or establish persistent backdoors for ongoing control.\nThe lack of input validation and the absence of secure file storage practices, such as storing files outside the web root or renaming them to non-executable formats, characterize the root cause of this vulnerability.\nThis flaw is remotely exploitable without complex requirements, making it a high-priority target for automated scanning and exploitation tools given its public status."
}