An unauthenticated SQL injection vulnerability in the itsourcecode Online Medicine Delivery System 1.0 enables unauthorized backend access and full administrative control.

This vulnerability is a SQL injection flaw (CWE-89) located in the Employee::employeeAuthentication function within /rider/login.php. An unauthenticated attacker can manipulate the emp_email parameter to inject malicious SQL queries, effectively bypassing the authentication mechanism entirely.

The exploitation of this vulnerability poses a severe risk to organizational integrity and data confidentiality. By bypassing authentication, an attacker gains unauthorized administrative access to the backend, enabling them to view sensitive employee and customer information, modify order statuses, or manipulate critical system data. Given the CVSS score of 7.3, this high-severity flaw represents a significant threat to business operations and potential regulatory non-compliance regarding data protection.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /rider/login.php endpoint via network-level controls or by placing the application behind an authenticated VPN.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests to login.php containing SQL syntax characters, such as single quotes, comment delimiters, or sleep commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the emp_email input field to mitigate the risk of remote exploitation.

Public Exploit Available: Yes: A published proof-of-concept exists and is attributed to the security researcher's technical write-up on GitHub.

Due to the ease of exploitation and the lack of a vendor-supplied patch, this vulnerability must be treated with high urgency. Organizations utilizing the itsourcecode Online Medicine Delivery System 1.0 should prioritize implementing the suggested compensating controls immediately to prevent unauthorized access to their backend management systems.