CVE-2026-85186
Deferred Deferred - Pending Action

Unrestricted File Upload in Online Medicine Delivery System

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulDB

Description
A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdateimage of the file /customer/controller.php?action=photos of the component Customer Controller. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85186
EUVD
EUVD-2026-70555

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
itsourcecode online_medicine_delivery_system 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85186 is a vulnerability in the Online Medicine Delivery System 1.0 that allows unrestricted file uploads due to improper validation in the doupdateimage function of the customer/controller.php file. Attackers can manipulate the photo argument to upload malicious files, potentially leading to remote code execution.

Detection Guidance

Check for unauthorized file uploads in the /customer/controller.php endpoint, particularly with action=photos or action=processorder parameters. Look for files with PHP code appended to GIF89a headers or files without proper validation. Monitor for unexpected system command execution or file reads like win.ini access.

Impact Analysis

This vulnerability allows attackers to upload and execute malicious files on the server, potentially leading to full system compromise. Attackers could gain control over the server, access sensitive data, or use the system as a pivot point to attack other systems in the network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance with these regulations.

Mitigation Strategies
  • Implement file extension whitelists to block non-image uploads.
  • Randomize uploaded filenames to prevent predictable access paths.
  • Disable PHP execution in directories where files are uploaded.
  • Add validation to the processorder() function to check file types.
  • Store uploaded files outside the web root to limit exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85186. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart