CVE-2026-85187: SQL Injection in itsourcecode Online Medicine Delivery System

The vulnerability CVE-2026-85187 affects itsourcecode Online Medicine Delivery System version 1.0. It is a SQL injection issue in the Order::pupdate function of the Order Status Update component, located in /rider/orders/controller.php?action=edit&actions=confirm. The ID argument is improperly sanitized, enabling remote attackers to inject SQL commands. The vulnerability is remotely exploitable without authentication and has been publicly disclosed. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access or modification. The impact is rated medium severity with limited confidentiality, integrity, and availability impact as per the CVSS 4.0 vector. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to apply input validation and sanitization on the ID parameter in the affected function to mitigate SQL injection risks. Monitor official vendor channels for updates or patches.