CVE-2026-85208 Details
Description
A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
A file upload vulnerability allowing remote code execution has been identified in itsourcecode Online Medicine Delivery System version 1.0. The issue resides in the Order Management Controller, specifically within the doInsert function of the file controller.php, located in the rider/orders directory. The vulnerability arises because the file upload mechanism uses getimagesize() for validation, but fails to enforce a whitelist for file extensions or rename uploaded files. This oversight enables an attacker to upload a crafted GIF89a image containing PHP code, which the server executes as a script.
To address this vulnerability, fix the authentication function to properly terminate PHP execution after a redirect. Implement a file extension whitelist to restrict uploads to specific image types, randomly rename uploaded files, and disable PHP execution in the directory where files are uploaded.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/boyslikesports/202607_vul_dir/blob/main/H-12-FileUpload-RCE-RiderOrders_en.md | [email protected] | ExploitRemedy |
| https://itsourcecode.com/ | [email protected] | Vendor |
| https://vuldb.com/cve/CVE-2026-85208 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/892999 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/398416 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/398416/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| itsourcecode Online Medicine Delivery System | 1.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | CVE Modified | CISA-ADP |
| Sep 3, 2026 | New CVE Received | [email protected] |