Description

A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file /drug_recommender/Admin/edit_user.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-20T13:17:46.540Z",
  "pubdate": "2026-09-20T13:17:46.540Z",
  "executiveSummary": "A SQL injection vulnerability exists within the SourceCodester Drug Recommendation System 1.0. The vulnerability resides in the /drug_recommender/Admin/edit_user.php script, specifically stemming from improper neutralization of input data supplied via the ID argument.\nThis vulnerability allows an unauthenticated or authenticated remote attacker to execute arbitrary SQL commands against the backend database management system. By injecting malicious payloads into the ID parameter, an attacker can manipulate database queries to bypass security controls, gain unauthorized access to sensitive administrative or user data, modify record contents, or potentially execute administrative database operations.\nGiven that the exploit is publicly available, the risk of exploitation is elevated. The vulnerability poses a critical threat to data integrity, confidentiality, and system availability. Successful exploitation requires no specific user interaction, and the attack can be launched remotely, making it a significant concern for installations of this software.",
  "technicalDetails": "The vulnerability is classified as an SQL injection, occurring within the /drug_recommender/Admin/edit_user.php file of the SourceCodester Drug Recommendation System 1.0. The root cause is the failure of the application to properly sanitize or parameterize the 'ID' parameter before incorporating it into a database query. This oversight enables the injection of arbitrary SQL fragments into the underlying database command.\nThe attack flow begins with the remote attacker identifying the entry point, the ID parameter, which is likely used in a backend query to retrieve or update user information. By crafting a specifically engineered malicious request—such as substituting the expected integer ID with a string containing SQL meta-characters like single quotes ('), comment operators (-- or #), or UNION SELECT statements—the attacker can break out of the intended query context.\nUpon transmission, the application executes the modified query string directly against the database. If successful, the database engine processes the injected commands as part of the primary statement. This allows the attacker to perform several malicious activities, including but not limited to: bypassing authentication checks, extracting the entire contents of the database (e.g., administrator credentials, user health data, or system configuration), modifying sensitive data, or deleting records. In some database configurations, if the database user has sufficient privileges, the attacker might be able to read or write files on the underlying filesystem or execute system commands.\nThe vulnerability is accessible via standard HTTP requests and does not require complex or multi-stage exploitation sequences. Because the application processes user-supplied input without implementing parameterized queries or prepared statements, it remains susceptible to various SQL injection techniques, including error-based, union-based, or boolean-blind injection. The exposure is total, as the affected function is accessible to any remote entity capable of reaching the web server, representing a severe risk to the confidentiality and integrity of the data managed by the Drug Recommendation System."
}