Online Medicine Delivery System CVE-2026-82610

No special conditions are required - the vulnerability is present in the default, unauthenticated login interface at /rider/login.php, which is accessible to any network-reachable client. The CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) confirms no authentication, user interaction, complex timing, or non-default configuration is needed. Exploitation is bounded only by TCP reachability to the application server on its HTTP/HTTPS port. The attacker must submit an HTTP request to the login form with a manipulated emp_email value; no prior account, session, or system access is required. Limiting factors are exclusively environmental: network segmentation restricting access to the application, or IP-allowlist controls on the login endpoint.

The CVSS 4.0 score of 6.9 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects a network-accessible, unauthenticated, low-complexity attack requiring no special timing - real-world exploitability is high. The E:P environmental metric confirms a public proof-of-concept is available, which substantially lowers the skill threshold for exploitation. The impact metrics VC:L/VI:L/VA:L are conservative for a SQL injection flaw that can bypass authentication; in practice, a successful authentication bypass grants attacker access to rider-level application functions and potentially the full underlying database schema, which may contain patient and medication records if deployed operationally. No CISA KEV listing exists, indicating no confirmed mass exploitation, but the public POC availability means this gap could close quickly. The product originates from an educational code repository, so production deployment is likely limited and informal; however, any deployed instance - including small clinics or pharmacy delivery operations that adopted the demo code - should treat this as urgent given zero prerequisites for exploitation.

An unauthenticated attacker navigates to the publicly accessible /rider/login.php page and submits a crafted SQL injection string in the emp_email field - such as a classic tautological bypass - causing the employeeAuthentication query to return a valid row and grant rider-level session access without credentials. With a public proof-of-concept available at the referenced GitHub repository, the attack requires no specialized knowledge beyond running the documented payload against a reachable instance.