A SQL injection vulnerability exists in the Customer::find_phone function within the Password Recovery interface of itsourcecode Online Medicine Delivery System 1.0. By appending malicious SQL to the phonenumber argument, an attacker can manipulate the database query. The affected parameter is directly concatenated into an SQL statement, allowing arbitrary queries that can read or modify sensitive data. Because the flaw is accessed over the web, remote attackers can trigger it without authentication, potentially exposing the entire database.

The vulnerability affects itsourcecode Online Medicine Delivery System version 1.0. The specific component is the Password Recovery interface located at /passwordrecover.php, where the Customer::find_phone method processes the phone number field. Only the released 1.0 build appears to be impacted; no other versions are listed.

With a CVSS score of 6.9, the risk is considered moderate. The EPSS score is not available, and the issue has not been listed in the CISA KEV catalog, suggesting limited exploitation awareness. Nevertheless, because the flaw is reachable over the internet and does not require authentication, a remote attacker can craft a request to the passwordrecover.php endpoint, insert malicious SQL, and potentially read or alter data. No official workaround is provided, so the vulnerability remains open until a vendor patch becomes available.