CVE-2026-85186: itsourcecode Online Medicine Delivery System Customer Controller controller.php doupdateimage unrestricted upload
A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdateimage of the file /customer/controller.php?action=photos of the component Customer Controller. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs privileges sufficient to access the Customer Controller photo update function. The attack can be performed remotely and does not require user interaction.
Which deployment should be considered affected?
itsourcecode Online Medicine Delivery System 1.0 is identified as affected. The vulnerable endpoint is /customer/controller.php?action=photos, specifically the doupdateimage function's photo argument.
What is the risk if exploitation succeeds?
Successful manipulation of the photo argument can result in an unrestricted file upload. The provided severity vector indicates potential low impact to confidentiality, integrity, and availability.
How urgent is mitigation?
Public exploit availability is reported, so systems exposing the affected functionality should be prioritized for review and mitigation. The available data does not identify a patch or workaround.