An unauthenticated SQL injection vulnerability in the itsourcecode Online Medicine Delivery System allows remote attackers to bypass authentication and gain unauthorized access to customer accounts.

The application fails to sanitize the U_USERNAME parameter before concatenating it into an SQL query within the Customer::cusAuthentication function. This allows an unauthenticated remote attacker to inject malicious SQL commands, bypass password verification, and hijack customer sessions.

Successful exploitation of this vulnerability leads to total compromise of customer accounts, exposing sensitive personal data and order history. Because the attacker can authenticate as any user without credentials, this flaw poses a severe risk of unauthorized order placement, account modification, and potential data exfiltration. Given the CVSS score of 7.3, this is a high-severity issue that directly threatens the integrity and confidentiality of the platform.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the login.php interface or implement robust input validation to filter malicious characters from the U_USERNAME field.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous POST requests to login.php containing SQL syntax characters, such as single quotes or comment delimiters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the login interface.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up referenced by the CVE record.

Given the ease with which an attacker can bypass authentication, this vulnerability represents a significant risk to the application. Organizations utilizing this software should prioritize the implementation of compensating controls, such as WAF filtering, while actively seeking a secure code update from the vendor to remediate the underlying lack of parameterized queries.