Description
A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the file /rider/orders/controller.php?action=edit&actions=confirm of the component Order Status Update. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-09-03
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A tainted ID parameter in the Order::pupdate function of itsourcecode’s Online Medicine Delivery System allows attackers to inject arbitrary SQL statements. This vulnerability enables unauthenticated execution of SQL queries that can read, modify, or delete data stored in the application’s database, threatening the confidentiality and integrity of sensitive information such as user records, prescriptions, and financial transactions.

Affected Systems

Vulnerable only in itsourcecode’s Online Medicine Delivery System version 1.0, specifically the Order Status Update controller located in rider/orders/controller.php. The flaw affects any deployment that exposes the edit/confirm actions without a protective patch.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity. The EPSS score is not available, yielding an uncertain likelihood of exploitation; however, the vulnerability is remotely exploitable through standard web requests and has been publicly disclosed. No remote code execution capability is noted, and the vulnerability is not yet listed in the CISA KEV catalog, suggesting no widespread exploitation at present.

Generated by OpenCVE AI on September 3, 2026 at 20:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑provided patch or upgrade to a secured release that removes the SQL injection in Order::pupdate
  • If no patch exists, immediately restrict access to the edit/confirm endpoint so that only authenticated and authorized users can reach it, using web‑server or application‑firewall rules
  • Refactor the affected code to use parameterized queries or prepared statements for all database interactions involving user‑supplied IDs and validate those IDs to be numeric, rejecting any non‑numeric input

Generated by OpenCVE AI on September 3, 2026 at 20:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the file /rider/orders/controller.php?action=edit&actions=confirm of the component Order Status Update. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Title itsourcecode Online Medicine Delivery System Order Status Update controller.php pupdate sql injection
First Time appeared Itsourcecode
Itsourcecode online Medicine Delivery System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:online_medicine_delivery_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode online Medicine Delivery System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Online Medicine Delivery System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-04T15:15:24.305Z

Reserved: 2026-09-03T11:53:58.738Z

Link: CVE-2026-85187

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-03T18:17:33.707

Modified: 2026-09-03T19:06:52.837

Link: CVE-2026-85187

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T20:30:10Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')