Description

A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file /drug_recommender/Admin/add_symptom. Performing a manipulation of the argument txtname results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.4",
  "pubDate": "2026-09-20T13:17:46.723Z",
  "pubdate": "2026-09-20T13:17:46.723Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability has been identified in the Drug Recommendation System 1.0, specifically within the /drug_recommender/Admin/add_symptom administrative module. The flaw exists due to improper sanitization of user-supplied data passed through the txtname parameter. An unauthenticated or authenticated remote attacker can exploit this weakness by injecting malicious JavaScript payloads, which are then executed within the browser context of other users or administrators visiting the affected page. Successful exploitation permits the execution of arbitrary scripts, potentially leading to unauthorized session hijacking, theft of administrative cookies, unauthorized actions performed on behalf of the victim, or the redirection of users to malicious third-party domains. Given that the exploit has been publicly disclosed, the system remains at high risk for exploitation by threat actors attempting to compromise administrative accounts or user sessions. The vulnerability underscores a failure to implement adequate input validation and output encoding mechanisms for administrative interface parameters.",
  "technicalDetails": "The vulnerability is a classic case of Reflected Cross-Site Scripting (XSS) located within the administrative workflow of the Drug Recommendation System 1.0. The root cause resides in the server-side processing logic of the /drug_recommender/Admin/add_symptom script, which fails to correctly sanitize or escape the input provided in the txtname parameter before rendering it back into the HTTP response body.\nThe attack flow begins when an attacker crafts a malicious URL containing a JavaScript payload within the txtname argument. Because the application processes this input without validating for structural integrity or character encoding, the server reflects the payload directly into the HTML document returned to the client. When a victim, particularly an administrative user with elevated privileges, accesses the manipulated link, the victim's browser interprets the malicious script as legitimate code originating from the trusted domain of the Drug Recommendation System.\nThis execution occurs within the security context of the victim's current session. Consequently, the injected payload gains full access to the Document Object Model (DOM) of the page, allowing the attacker to perform several malicious operations. These include, but are not limited to, stealing session tokens or cookies (if the HttpOnly flag is not strictly enforced), capturing keystrokes, modifying the DOM to present fraudulent forms, or performing unauthorized administrative actions such as creating new user accounts or deleting data. Because the exploit is triggered via a standard HTTP GET or POST request, the attack can be launched remotely by simply enticing a victim to visit the crafted URL. The lack of context-aware output encoding means that any script tags or event handlers (e.g., onerror, onload, onmouseover) injected into the txtname parameter will be executed upon page load or interaction. This vulnerability represents a significant security oversight in the handling of input-to-output reflection patterns, particularly within a sensitive administrative component where the impact of account compromise is magnified."
}