Itsourcecode Systems: Six Vulnerabilities Including SQLi and Upload Flaws Disclosed Together
Six vulnerabilities, including SQL injection and unrestricted upload flaws, were disclosed for itsourcecode systems within a single nine-hour window.
Key findings
- Six vulnerabilities disclosed for itsourcecode Sales and Inventory System 1.0 and Online Medicine Delivery System 1.0.
- Flaws include SQL injection, unrestricted upload, and cross-site scripting.
- CVE-2026-85383 and CVE-2026-85207 have publicly available exploits.
- High-severity flaws (CVSSv3 7.3) include unrestricted upload (CVE-2026-85208) and SQL injection (CVE-2026-85187).
- Vulnerabilities disclosed within a 9-hour window on September 3-4, 2026.
On September 4, 2026, a batch of six vulnerabilities was disclosed for products from itsourcecode, spanning SQL injection, unrestricted upload, and cross-site scripting flaws. The disclosures occurred within a nine-hour window, highlighting potential risks for users of the affected systems.
The vulnerabilities affect two distinct itsourcecode products: the Sales and Inventory System 1.0 and the Online Medicine Delivery System 1.0.
SQL Injection Vulnerabilities: Three SQL injection vulnerabilities were identified. CVE-2026-85383, a medium-severity flaw in the Sales and Inventory System 1.0, resides in the /pages/inv_del.php file and can be triggered by manipulating the 'ID' argument. In the Online Medicine Delivery System 1.0, CVE-2026-85205 (medium severity) affects the addwishlist function in /customer/controller.php?action=addwish, exploitable via the 'proid' argument. Additionally, CVE-2026-85187, a high-severity vulnerability, impacts the Order Status Update component in /rider/orders/controller.php?action=edit&actions=confirm, specifically the Order::pupdate function, through manipulation of the 'ID' argument.
Unrestricted Upload Vulnerabilities: Two unrestricted upload flaws were also disclosed. CVE-2026-85208, a high-severity vulnerability in the Online Medicine Delivery System 1.0, is located in the Order Management Controller's doInsert function within /rider/orders/controller.php?action=add, allowing for unrestricted uploads via the 'image' argument. Another medium-severity unrestricted upload vulnerability, CVE-2026-85186, affects the Customer Controller's doupdateimage function in /customer/controller.php?action=photos, exploitable by manipulating the 'photo' argument.
Cross-Site Scripting Vulnerability: A low-severity cross-site scripting (XSS) vulnerability, CVE-2026-85207, was found in the itsourcecode Online Medicine Delivery System 1.0. This flaw exists in an unknown function within /index.php?q=orderdetails and can be exploited by manipulating the 'location' argument, potentially leading to remote attacks.
Exploitation and Response: The disclosures indicate that exploits for CVE-2026-85383 and CVE-2026-85207 are publicly available and may be in use. The descriptions for CVE-2026-85208, CVE-2026-85205, CVE-2026-85187, and CVE-2026-85186 mention that the attacks can be executed remotely, with CVE-2026-85187 noting the exploit may be used. Specific patch information or version updates were not detailed in the provided vulnerability descriptions.
Users of the itsourcecode Sales and Inventory System 1.0 and Online Medicine Delivery System 1.0 are advised to review these vulnerabilities and apply any available security updates or mitigations provided by itsourcecode. The simultaneous disclosure of these varied vulnerabilities underscores the importance of timely patching and security assessments for these systems.