The Online Medicine Delivery System 1.0 contains a flaw in the order management controller’s doInsert function that allows an attacker to upload any file by manipulating the image parameter. Because the system accepts the file without validating its type or enforcing proper access checks (CWE-434 and CWE-284), a malicious actor can place a script or binary that may be executed later. The public release of the exploit raises the risk that unauthenticated or insufficiently authenticated users can trigger the upload, leading to remote code execution on the host. The CVSS score of 6.9 indicates a moderate severity, but the potential impact is high if the uploaded file gains executable privileges.

The Online Medicine Delivery System 1.0, provided by itsourcecode, is affected. The flaw is located in the Order Management Controller’s controller.php file, in the doInsert (add action) routine.

The vulnerability can be exploited over the network via the web interface, requiring that an attacker can send a request to the add action. An attacker may craft a request that changes the image argument to upload a malicious file. Because no EPSS score is available and the issue is not listed in CISA KEV, the immediate awareness is limited to the public exploit. However, the existence of a publicly available exploit and the moderate CVSS suggest a non‑negligible risk to any deployment that does not restrict file uploads or enforce proper authentication for the order management endpoint.