Description

A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /drug_recommender/Admin/change_password of the component Password Change. Performing a manipulation of the argument txtoldpassword/txtnewpassword results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-20T15:16:30.730Z",
  "pubdate": "2026-09-20T15:16:30.730Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the Drug Recommendation System 1.0 password change functionality. The vulnerability resides in the /drug_recommender/Admin/change_password endpoint, where the application fails to properly sanitize user-supplied input provided via the txtoldpassword and txtnewpassword arguments.\nThis flaw allows a remote, unauthenticated or authenticated attacker to inject malicious scripts into the web application, which are then executed within the context of the victim's browser session. Successful exploitation could lead to unauthorized actions, session hijacking, credential theft, or the redirection of users to malicious websites. Given that the exploit has been publicly disclosed, the risk is elevated, necessitating immediate attention to prevent potential system compromise and unauthorized data access.",
  "technicalDetails": "The vulnerability is identified as a Stored or Reflected Cross-Site Scripting (XSS) flaw located within the /drug_recommender/Admin/change_password file of the Drug Recommendation System 1.0. The root cause of this vulnerability is the improper neutralization of input within the 'txtoldpassword' and 'txtnewpassword' fields during the password update process. The application accepts these parameters and reflects them back to the user interface without adequate output encoding or validation.\nThe attack flow begins when an attacker crafts a malicious payload containing JavaScript, typically enclosed within <script> tags or injected into event handlers (e.g., onerror, onload). The attacker submits this payload through the vulnerable password change form. When the server processes this request, it fails to sanitize the input before reflecting it back in the HTTP response. Consequently, the user's browser interprets the injected payload as legitimate application code and executes it within the security domain of the vulnerable site.\nBecause the application does not implement context-aware output encoding, the browser is unable to distinguish between the intended data and the malicious script. This allows the attacker to execute arbitrary code with the same privileges as the victim's session. In the context of an administrative panel, this is particularly critical, as it could allow an attacker to hijack an administrator's session, capture sensitive credentials, modify system configurations, or perform unauthorized administrative actions.\nThe vulnerability is accessible remotely via the network, requiring no specialized access beyond the ability to reach the target web server. As the exploit is publicly available, the barrier to entry for attackers is minimal. Exploitation results in a failure of the application's integrity and confidentiality, as the script can be used to exfiltrate cookies or manipulate the Document Object Model (DOM) of the page to present phishing content to the user, effectively bypassing standard authentication protections."
}