CVE-2026-85186: Unrestricted Upload in itsourcecode Online Medicine Delivery System

This vulnerability affects the Online Medicine Delivery System 1.0 by itsourcecode. The issue resides in the doupdateimage function located in /customer/controller.php?action=photos within the Customer Controller component. An attacker can manipulate the photo parameter to perform an unrestricted file upload, potentially allowing malicious files to be uploaded remotely. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. There is no vendor advisory or patch available at this time, and no known exploits are reported in the wild despite public exploit availability.

Successful exploitation could allow an attacker to upload arbitrary files to the affected system remotely, which may lead to further compromise depending on the server configuration and file handling. The vulnerability has low vector complexity and requires no user interaction, but limited privileges are needed. The overall impact is rated medium based on the CVSS score of 5.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement strict input validation and file type restrictions on uploads, and monitor for suspicious upload activity. Avoid exposing the vulnerable endpoint to untrusted users if possible.