Executive Summary
A SQL injection vulnerability (CVE-2026-82610) has been disclosed in itsourcecode's Online Medicine Delivery System 1.0, a PHP-based pharmacy/delivery management application. The flaw sits in the Employee::employeeAuthentication function of /rider/login.php, part of the rider/employee login interface. The emp_email parameter is not properly sanitized, allowing an unauthenticated, remote attacker to inject SQL statements through the login form.
CVSS Score: 7.3 (High, CVSS 3.1/3.0) — assigned by VulDB, tracked as VDB-397111.
A working exploit has already been published, lowering the bar for opportunistic attacks against any internet-facing deployment of this application.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-82610 |
| CVSS Score | 7.3 (High) |
| Type | SQL Injection (CWE-89) |
| Component | Login Interface — /rider/login.php |
| Function | Employee::employeeAuthentication |
| Parameter | emp_email |
| Attack Vector | Network (no authentication required) |
| Exploit Status | Publicly available |
Affected Versions
| Product | Affected Versions | Fixed Version |
|---|---|---|
| itsourcecode Online Medicine Delivery System | 1.0 | None available |
itsourcecode is a source-code marketplace popular with students and small deployments for capstone and portfolio projects; these systems occasionally end up running in low-scrutiny production or demo environments, which is where exposure typically shows up.
Attack Vector
1. Attacker locates a deployment of the Online Medicine Delivery System's rider/employee login page
2. Attacker submits a crafted emp_email value containing SQL metacharacters
3. The unsanitized value is concatenated directly into the authentication query
4. Malicious SQL executes against the backend database
5. Attacker bypasses authentication and/or extracts database contentsImpact of Successful Exploitation
| Impact | Description |
|---|---|
| Authentication Bypass | Log in as an employee/rider without valid credentials |
| Data Exposure | Read patient, order, and account records from the database |
| Data Manipulation | Alter or delete records depending on DB permissions |
| Pivot Point | Use the compromised app as an entry point into connected pharmacy or delivery infrastructure |
This is one of a cluster of related SQL injection flaws reported in the same product line — CVE-2026-82611 affects the customer login's U_USERNAME parameter, and CVE-2026-82612 affects the product detail page — suggesting the application lacks consistent input sanitization across its login and query layers.
Remediation
No vendor-supplied patch is currently available. Until one is released:
- Take the application offline or restrict access to trusted networks only if it is internet-facing.
- Deploy a WAF rule to block SQL injection patterns on the
/rider/login.phpendpoint and other login/query parameters. - Review source code for parameterized query support — replace raw string concatenation in authentication queries with prepared statements/bound parameters.
- Audit database logs for anomalous queries against the
emp_emailfield and related login endpoints. - Rotate credentials for any accounts with access to the affected instance, and review for unauthorized employee/rider accounts.
- Segment the database so the application account has least-privilege access rather than broad read/write rights.
Detection Indicators
| Indicator | Description |
|---|---|
Malformed emp_email values in access logs | Attempted SQL injection payloads (e.g. quotes, UNION, comment sequences) |
| Unexpected employee/rider logins | Possible authentication bypass |
| Database errors referencing the login query | Failed or exploratory injection attempts |
| Unusual outbound data transfer from the DB host | Post-exploitation data exfiltration |