Weining Xiao

A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdateimage of the file /customer/controller.php?action=photos of the component Customer Controller. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Online Medicine Delivery System version 1.0 **Description** A remote SQL injection exists in the Wishlist component. The issue occurs within the `addwishlist()` function located in the `/customer/controller.php?action=addwish` endpoint when processing the `proid` variable. SQL injection is a technique where an attacker inserts malicious SQL code into a query, potentially allowing unauthorized access to or manipulation of the database. **Recommendations** As a temporary workaround, avoid using the `proid` parameter in the `/customer/controller.php?action=addwish` endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the file /rider/orders/controller.php?action=edit&actions=confirm of the component Order Status Update. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Online Medicine Delivery System version 1.0 **Description** A remote SQL injection is possible via the `loadResultList()` function within the `/index.php?q=single-item` endpoint of the Product Detail Page component. This occurs when the `ID` variable is manipulated, allowing an attacker to execute unauthorized database queries. **Recommendations** As a temporary workaround, restrict access to the `/index.php?q=single-item` endpoint or avoid using the `ID` parameter until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Online Medicine Delivery System version 1.0 **Description** A SQL injection flaw exists in the Login Interface component within the `/rider/login.php` file. The issue occurs in the `Employee::employeeAuthentication()` function when processing the `emp email` variable, allowing a remote attacker to manipulate database queries. **Recommendations** As a temporary workaround, restrict access to the `/rider/login.php` endpoint or avoid using the `emp email` parameter until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Online Medicine Delivery System version 1.0 **Description** An issue exists in the Customer Login Interface within the `/login.php` file. The `Customer::cusAuthentication()` function is susceptible to SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. This occurs through the manipulation of the `U USERNAME` argument and can be triggered remotely. **Recommendations** Update itsourcecode Online Medicine Delivery System version 1.0 to a patched version. As a temporary workaround, restrict access to the `/login.php` endpoint or avoid using the `U USERNAME` parameter until a fix is applied.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Online Medicine Delivery System version 1.0 **Description** An issue exists in the Product Search Interface component within the `/index.php?q=product` file. A remote attacker can perform a manipulation of the `Search` variable in the `loadResultList()` function, leading to a SQL injection. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** As a temporary workaround, restrict access to the `loadResultList()` function in the `/index.php?q=product` file or avoid using the `Search` parameter until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Online Medicine Delivery System version 1.0 **Description** A flaw in the Product Category Filter Interface allows remote attackers to perform SQL injection. This occurs through the manipulation of the `Category` argument within the `loadResultList()` function of the '/index.php?q=product' endpoint. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** As a temporary workaround, restrict access to the '/index.php?q=product' endpoint or avoid using the `Category` argument until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Online Medicine Delivery System version 1.0 **Description** An issue exists in the Password Recovery Interface component within the `/passwordrecover.php` file. The `Customer::find phone()` function fails to properly handle the `phonenumber` argument, allowing for remote SQL injection. SQL injection is a technique where an attacker inserts malicious SQL code into a query, potentially allowing them to manipulate the database. **Recommendations** Update itsourcecode Online Medicine Delivery System version 1.0 to a patched version. As a temporary mitigation, restrict access to the `/passwordrecover.php` file or avoid using the `phonenumber` argument until a fix is applied.

**Name of the Vulnerable Software and Affected Versions** Simple Laundry System version 1.0 **Description** Cross site scripting (XSS) occurs in the Parameter Handler component within the `/modstaffinfo.php` file. A remote attacker can trigger this issue by manipulating the `userid` argument. Cross site scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** As a temporary workaround, avoid using the `userid` parameter in the `/modstaffinfo.php` file until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Simple Laundry System version 1.0 **Description** An issue exists in the Parameter Handler component within the `/modifymember.php` file. Remote manipulation of the `firstName` argument allows for SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. **Recommendations** Update Simple Laundry System version 1.0 to a patched version. As a temporary mitigation, restrict access to the `/modifymember.php` file.

Name of the Vulnerable Software and Affected Versions Simple Laundry System version 1.0 Description A flaw exists in the /modifymember.php file within the Parameter Handler component, allowing for cross site scripting through manipulation of the `firstName` argument. This attack can be initiated remotely. The exploit has been published. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Simple Laundry System version 1.0 **Description** An issue exists in the Parameter Handler component within the '/modmemberinfo.php' endpoint. A remote attacker can perform cross-site scripting (XSS)—a technique used to inject malicious scripts into web pages viewed by other users—by manipulating the `userid` argument. **Recommendations** As a temporary workaround, avoid using the `userid` argument in the '/modmemberinfo.php' endpoint until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-513 version 1.0 **Description** A critical issue exists in the HTTP POST Request Handler component, specifically within the `formLanguageChange` function of the `/goform/formLanguageChange` file. Manipulation of the `curTime` argument can lead to a stack-based buffer overflow, potentially allowing for remote exploitation. The exploit for this issue has been publicly disclosed. This vulnerability affects products that are no longer supported by the maintainer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.