Description

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected by this issue is some unknown functionality of the file /Admin/edit_symptom.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-20T12:17:05.217Z",
  "pubdate": "2026-09-20T12:17:05.217Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in SourceCodester Drug Recommendation System 1.0. The vulnerability resides within the '/Admin/edit_symptom.php' file, specifically due to improper neutralization of input data handled by the 'ID' argument.\nThis flaw allows a remote, unauthenticated attacker to manipulate database queries, potentially leading to unauthorized data disclosure, modification, or deletion of sensitive information within the system's database.\nThe vulnerability is currently exposed through publicly available exploit code, increasing the likelihood of exploitation. Given the nature of a drug recommendation system, the integrity and confidentiality of the medical data managed by the platform are at significant risk.\nSuccessful exploitation allows for the execution of arbitrary SQL commands, potentially granting the attacker complete control over the backend database and the ability to bypass application-level access controls.",
  "technicalDetails": "The root cause of this vulnerability is improper input validation and sanitation of the 'ID' parameter before it is passed to a database query in '/Admin/edit_symptom.php'. The application fails to utilize prepared statements or parameterized queries, which are essential for preventing SQL injection attacks.\nWhen a request is made to the vulnerable component, the application constructs a SQL query by directly concatenating the user-supplied 'ID' value into the query string. An attacker can manipulate this parameter by injecting malicious SQL fragments.\nThe attack flow begins when an attacker sends a crafted HTTP GET or POST request to the '/Admin/edit_symptom.php' endpoint. By injecting SQL syntax (such as UNION-based injection or boolean-based blind injection) into the 'ID' parameter, the attacker alters the original query logic intended by the developer.\nFor instance, an attacker could append a payload designed to bypass authentication, extract information from system tables, or dump the contents of the database. Because the application processes these queries with the privileges of the database user, the impact is limited only by the permissions assigned to that account.\nAs the exploit is publicly available, the barrier to entry for potential attackers is extremely low. The vulnerability is network-accessible, meaning that if the application is exposed to the internet, any remote actor can initiate the attack without requiring prior authentication or specific system privileges.\nPost-exploitation impact includes full database compromise, potentially leading to the leakage of symptom data, administrative credentials, or other sensitive information hosted within the Drug Recommendation System 1.0 environment. In some scenarios, this may also facilitate further exploitation of the underlying database server, such as arbitrary file read/write operations or remote command execution, depending on the database configuration."
}