SQL Injection in Online Medicine Delivery System

A SQL injection vulnerability exists in the Online Medicine Delivery System version 1.0, specifically within the Employee::employeeAuthentication function located in the /rider/login.php file. The vulnerability is triggered by the improper sanitization of the emp_email argument during the authentication process. An unauthenticated attacker can supply crafted SQL statements via the emp_email parameter to manipulate database queries. Given that a public exploit exists for this vulnerability, the risk of exploitation by opportunistic threat actors is elevated. Successful exploitation allows for unauthorized authentication bypass, potential data exfiltration, or modification of administrative records within the backend database. Defenders should monitor web access logs for anomalous character sequences within the specified login parameter.

Impact

The vulnerability allows for full bypass of the rider authentication mechanism. If exploited, attackers can gain unauthorized access to the system, potentially exposing sensitive medical delivery records, employee information, and platform credentials. The impact is significant given the application's domain, potentially leading to unauthorized disclosure of personal health information (PHI) and PII.

Recommendation

• Implement input validation and parameterized queries in the /rider/login.php script to neutralize SQL injection vectors.
• Deploy WAF rules to detect and block SQL injection payloads targeting the emp_email parameter in HTTP POST requests.
• Review web server logs for high volumes of 4xx or 5xx errors directed at /rider/login.php, which may indicate automated exploitation attempts.
• Upgrade to a patched version of the Online Medicine Delivery System if available, or isolate the login interface from the public internet.