EUVD-2026-68339
GHSA-g8j6-f26h-5w34
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate exposed /login.php endpoint
-
DeliveryCraft SQL injection payload in U_USERNAME field
-
ExploitSubmit unauthenticated POST request
-
ExecutionBypass Customer::cusAuthentication logic
-
PersistAuthenticate as arbitrary customer
-
ImpactEnumerate or exfiltrate database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions required - the vulnerable parameter U_USERNAME is present on the default customer login form at /login.php in a standard installation of Online Medicine Delivery System 1.0, and the CVSS vector confirms unauthenticated (PR:N), network-accessible (AV:N), low-complexity (AC:L) exploitation with no user interaction (UI:N). The primary limiting factor is deployment context: the application must be internet- or network-exposed; installations running only on localhost or behind strict IP allowlists reduce reachability. No specific non-default feature or configuration toggle is required to trigger the flaw. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/E:P) scores 6.9 Medium, but this appears to underweight the practical impact of SQL injection in an authentication function - which typically enables full authentication bypass (VI:H) and database read access (VC:H). The E:P modifier confirms a public POC exists, materially increasing exploitation likelihood. The application is not listed in CISA KEV and EPSS data is absent from the provided inputs, but the combination of unauthenticated network access, no complexity requirements, and a public exploit represents real-world exploitability wherever this software is deployed. The primary limiting factor is the application's niche, low-deployment-footprint nature - this is not enterprise software. Real-world risk is moderate for any specific deployment but the threat pool is narrow. |
| Exploit ScenarioDerived | An unauthenticated attacker submits an HTTP POST request to /login.php with a crafted U_USERNAME value such as ' OR '1'='1' -- , causing the Customer::cusAuthentication SQL query to return a truthy result and log in as an arbitrary customer without a valid password. The publicly available POC on GitHub (https://github.com/boyslikesports/202607_vul_dir/blob/main/C-02-SQLi-Customer-Auth-Bypass_en.md) documents this authentication bypass technique, and the same injection point could be extended with UNION-based or time-based payloads to enumerate the underlying database. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate the U_USERNAME parameter in the Customer::cusAuthentication function at /login.php, enabling authentication bypass and potential database extraction. A public proof-of-concept exploit is available on GitHub, confirmed by the CVSS 4.0 E:P (proof-of-concept) modifier and a linked exploit write-up. No patch has been identified; this is a small PHP application likely used in academic or learning environments with limited production exposure.
RemediationAI
No vendor-released patch has been identified at time of analysis. The primary fix is to rewrite the Customer::cusAuthentication function to use parameterized queries (PHP PDO or MySQLi prepared statements), eliminating the injection surface entirely - this is the only durable remediation. As compensating controls for deployments that cannot be immediately modified: restrict access to /login.php at the network perimeter or web server level to trusted IP ranges, which reduces exposure at the cost of legitimate remote user access. Deploy a Web Application Firewall (WAF) rule blocking common SQL metacharacters (' -- ; OR) in POST parameters, noting WAFs can be bypassed by determined attackers and should not be treated as a permanent fix. Monitor database query logs for anomalous authentication patterns. The itsourcecode project page is at https://itsourcecode.com/ but no advisory or patched release was found there.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-89 (SQL Injection) flaw in a PHP web application identified by CPE cpe:2.3:a:itsourcecode:online_medicine_delivery_system:*:*:*:*:*:*:*:*. The affected code path is the Customer::cusAuthentication method in /login.php, which processes the U_USERNAME POST parameter without adequate sanitization or parameterized queries before incorporating it into a SQL statement. This pattern is characteristic of legacy PHP code that concatenates user-controlled input directly into SQL DML, allowing an attacker to alter query logic. The itsourcecode platform hosts demo and tutorial PHP projects, and this application is likely built without a framework that would enforce ORM-level escaping or prepared statements.
Know when Online Medicine Delivery System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable auth bypass via SQLi grants full DB read (C:H) and authentication integrity violation (I:H); no availability impact expected.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function Customer::cusAuthentication of the file /login.php of the component Customer Login Interface. This manipulation of the argument U_USERNAME causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate
Unrestricted file upload in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes unauthenticated attackers to direct database m
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows remote attackers to manipulate the ID argument
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes the Product Search Interface to remote unauthe
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes database contents to remote unauthenticated at
Reflected cross-site scripting in itsourcecode Online Medicine Delivery System 1.0 allows an authenticated remote attack
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows remote authenticated customers to manipulate th
Exploit-DB