An unauthenticated SQL injection vulnerability in the Online Medicine Delivery System password recovery module poses a critical risk of full database compromise and unauthorized data exfiltration.

The application fails to sanitize the phonenumber parameter within the /passwordrecover.php file, allowing an unauthenticated attacker to inject malicious SQL commands into both SELECT and INSERT operations. The vulnerability leverages time-based blind injection techniques, enabling the extraction of sensitive database content without requiring any prior user privileges.

The ability for an unauthenticated attacker to perform time-based SQL injection provides a direct path to total database disclosure. Successful exploitation could lead to the theft of customer personal information, user credentials, and password hashes, causing significant reputational damage and legal liability. Given the CVSS score of 7.3, this high-severity flaw demands immediate attention to prevent unauthorized access to the underlying data store.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /passwordrecover.php endpoint or disable the password recovery functionality entirely until a secure update is released by the vendor.

Proactive Monitoring: Security teams should monitor web access logs for anomalous POST requests to the password recovery interface that contain SQL syntax, such as SLEEP() commands or character-based injection sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and block malicious input targeting the phonenumber parameter.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the technical write-up provided by the researcher on GitHub.

The presence of a publicly available exploit for this SQL injection vulnerability creates an urgent risk for any organization deploying this software. Administrators must treat this as a high-priority incident and implement the recommended WAF rules or service restrictions immediately to prevent data exfiltration. Transitioning to a secure, supported platform is strongly advised if the vendor does not provide a verified security patch in the near term.