Description
A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function Customer::cusAuthentication of the file /login.php of the component Customer Login Interface. This manipulation of the argument U_USERNAME causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-08-31
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL injection allowing authentication bypass
Action: Patch / Update
AI Analysis

Impact

The vulnerability resides in the Customer::cusAuthentication function within /login.php of the Online Medicine Delivery System. By manipulating the U_USERNAME parameter, an attacker can inject arbitrary SQL, enabling unauthorized access or potentially sensitive data extraction. The affected code process user credentials without proper input validation or parameterization, leading directly to injection.

Affected Systems

The product impacted is itsourcecode Online Medicine Delivery System, version 1.0. Attackers can target the Customer Login Interface exposed by the component Customer Login Interface.

Risk and Exploitability

The CVSS score of 6.9 reflects elevated risk due to remote exploitation potential. EPSS data is not available, but public exploitation scripts are documented, indicating active usage. The vulnerability is not listed in CISA KEV, yet the exploit’s public availability suggests a non-negligible threat. Attack surface is reachable from any system with network access to the web interface, and no additional authentication is required to trigger the exploit.

Generated by OpenCVE AI on August 31, 2026 at 04:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • If the vendor releases an updated version or patch, migrate to the fixed version immediately.
  • Implement input validation and prepared statement practices in the Customer::cusAuthentication routine to eliminate unsanitized SQL usage.
  • Deploy application-level WAF rules to block SQL injection payloads and monitor login activity for suspicious patterns.

Generated by OpenCVE AI on August 31, 2026 at 04:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 31 Aug 2026 03:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function Customer::cusAuthentication of the file /login.php of the component Customer Login Interface. This manipulation of the argument U_USERNAME causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Title itsourcecode Online Medicine Delivery System Customer Login login.php cusAuthentication sql injection
First Time appeared Itsourcecode
Itsourcecode online Medicine Delivery System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:online_medicine_delivery_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode online Medicine Delivery System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Online Medicine Delivery System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-31T22:03:45.652Z

Reserved: 2026-08-30T07:43:35.876Z

Link: CVE-2026-82611

cve-icon Vulnrichment

Updated: 2026-08-31T21:51:47.640Z

cve-icon NVD

Status : Deferred

Published: 2026-08-31T04:17:28.317

Modified: 2026-08-31T22:17:27.530

Link: CVE-2026-82611

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T21:22:00Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')