Description

A vulnerability was determined in SourceCodester Drug Recommendation System 1.0. Impacted is an unknown function of the file /Admin/edit_class.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-10-05T02:16:48.307Z",
  "pubdate": "2026-10-05T02:16:48.307Z",
  "executiveSummary": "A SQL injection vulnerability exists in SourceCodester Drug Recommendation System 1.0 within the /Admin/edit_class.php file.\nThe vulnerability arises due to improper sanitization of user-supplied input provided to the ID argument.\nAn unauthenticated or authenticated remote attacker can manipulate the database query by injecting malicious SQL statements.\nSuccessful exploitation allows unauthorized access to the backend database, potentially leading to data exfiltration, unauthorized modification of sensitive information, or complete system compromise.\nThe vulnerability is currently publicly disclosed, increasing the risk of active exploitation by malicious actors.\nThis flaw represents a critical security risk to the integrity and confidentiality of the application's data.",
  "technicalDetails": "The vulnerability is located in the /Admin/edit_class.php component of SourceCodester Drug Recommendation System 1.0. The root cause is the failure of the application to properly sanitize and validate the 'ID' parameter before incorporating it into a SQL statement executed against the backend database.\nThe application follows a typical dynamic query construction pattern where the user-supplied 'ID' is concatenated directly into a SQL query string. This lack of parameterization or prepared statements allows an attacker to break out of the intended query structure by injecting SQL control characters (such as single quotes or comment markers).\nThe attack flow proceeds as follows: An attacker sends a crafted HTTP request to /Admin/edit_class.php, supplying a malicious payload within the 'ID' parameter. Because the input is not processed via prepared statements, the database engine interprets the injected malicious SQL commands as part of the authorized query. This may involve using UNION-based injection to append results from other tables to the output, or error-based techniques to extract database metadata.\nExploitation allows for arbitrary interaction with the database management system (DBMS). This includes the ability to bypass authentication, disclose sensitive drug or patient information, modify existing records, or potentially gain administrative access to the underlying server if the DBMS configuration permits stacked queries or file system interactions (e.g., INTO OUTFILE).\nThe vulnerability is remotely exploitable over a network, requiring no specific privileges if the vulnerable endpoint is exposed to the public. As the exploit is publicly disclosed, the barrier to entry is minimal, allowing even unskilled attackers to execute the attack using standard automated SQL injection tools or manual probes."
}