Description
A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is the function Employee::employeeAuthentication of the file /rider/login.php of the component Login Interface. The manipulation of the argument emp_email results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-08-31
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A security flaw was discovered in the employeeAuthentication method of the login.php file in itsourcecode's Online Medicine Delivery System. By manipulating the emp_email parameter an attacker can inject arbitrary SQL statements, enabling authentication bypass and manipulation of the underlying database. This vulnerability is identified as CWE-74 and CWE-89.

Affected Systems

The affected product is the Online Medicine Delivery System 1.0 from itsourcecode. The fault lies in the login interface accessed through rider/login.php. No other versions or products are listed as affected.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate risk. The exploit is publicly available, and the vulnerability can be triggered remotely via the web interface. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. Attackers who succeed in exploiting this flaw could compromise the confidentiality and integrity of the system’s data by executing arbitrary SQL commands against the database.

Generated by OpenCVE AI on August 31, 2026 at 04:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s security patch for Online Medicine Delivery System 1.0 that fixes the employeeAuthentication method.
  • If a patch is not yet available, restrict external access to the login.php endpoint or temporarily disable the employee authentication feature until a fix can be deployed.
  • Enforce strict input validation on the emp_email parameter, allowing only valid email formats and rejecting any characters that could form SQL syntax.
  • Adopt prepared statements or parameterized queries for all database interactions in the login component to eliminate unsanitized input usage.

Generated by OpenCVE AI on August 31, 2026 at 04:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is the function Employee::employeeAuthentication of the file /rider/login.php of the component Login Interface. The manipulation of the argument emp_email results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Title itsourcecode Online Medicine Delivery System Login login.php employeeAuthentication sql injection
First Time appeared Itsourcecode
Itsourcecode online Medicine Delivery System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:online_medicine_delivery_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode online Medicine Delivery System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Online Medicine Delivery System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-31T03:15:08.792Z

Reserved: 2026-08-30T07:43:31.635Z

Link: CVE-2026-82610

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-31T04:17:26.273

Modified: 2026-08-31T04:17:26.273

Link: CVE-2026-82610

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T04:30:18Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')