The vulnerability is an unrestricted file upload flaw located in the Customer Controller of the Online Medicine Delivery System. A malicious user can manipulate the photo parameter to upload arbitrary files. This can compromise confidentiality, integrity, and availability by allowing an attacker to upload a script or malicious file that could be executed on the server, potentially leading to remote code execution or other destructive actions. The weakness is rooted in improper access control (CWE-284) and an unrestricted upload of dangerous file types (CWE-434).

The affected product is itsourcecode Online Medicine Delivery System version 1.0. The flaw exists in the function doupdateimage of the file /customer/controller.php when the action is set to photos within the Customer Controller component.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, but an exploit has been made publicly available. Based on the description, it is inferred that the attack vector is remote, requiring only network access to the deployment. Successful exploitation would enable the attacker to upload malicious files that the server may execute, thereby compromising the application and potentially the underlying host system.