A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is the function Employee::employeeAuthentication of the file /rider/login.php of the component Login Interface. The manipulation of the argument emp_email results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

A SQL injection vulnerability has been identified in itsourcecode Online Medicine Delivery System version 1.0. The flaw exists in the Employee::employeeAuthentication function within the /rider/login.php file at the Login Interface component. Attackers can manipulate the emp_email argument to perform SQL injection attacks. The vulnerability is remotely exploitable without requiring physical access to the target system. A public exploit has already been released, increasing the risk of active exploitation. This type of vulnerability can allow attackers to bypass authentication and gain unauthorized access to the system. The affected product is a web-based medicine delivery management system. The issue has been documented in VulDB and the National Vulnerability Database. Organizations using this software should apply patches or mitigations immediately given the public availability of the exploit.