CVE-2026-85208

Received Received - Intake

Unrestricted File Upload in Online Medicine Delivery System

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulDB

Description

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-03

Last Modified

2026-09-03

Generated

2026-09-04

AI Q&A

2026-09-04

EPSS Evaluated

N/A

NVD

CVE-2026-85208

Affected Vendors & Products

Vendor	Product	Version / Range
itsourcecode	online_medicine_delivery_system	1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an unrestricted file upload flaw in the Online Medicine Delivery System 1.0. It exists in the doInsert function of the Order Management Controller, specifically in the file /rider/orders/controller.php?action=add. An attacker can manipulate the 'image' argument to upload malicious files without restrictions.

Impact Analysis

This flaw allows remote attackers to upload arbitrary files to the server. This could lead to execution of malicious code, defacement of the website, or unauthorized access to sensitive data. Since the exploit is public, the risk of attacks is higher.

Compliance Impact

This vulnerability could lead to data breaches, exposing personal or medical data. GDPR requires protection of personal data, and HIPAA mandates safeguards for health information. A breach could result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Immediately restrict file uploads to the /rider/orders/controller.php?action=add endpoint. Validate all file types and extensions strictly. Disable the image parameter in the doInsert function if not required. Monitor network traffic for unusual file upload patterns or unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-85208. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70