Description

A vulnerability was determined in SourceCodester Drug Recommendation System 1.0. Impacted is an unknown function of the file /drug_recommender/index.php. Executing a manipulation of the argument full name can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-20T16:16:55.307Z",
  "pubdate": "2026-09-20T16:16:55.307Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in version 1.0 of the SourceCodester Drug Recommendation System. The vulnerability resides within the /drug_recommender/index.php file, specifically stemming from improper input validation of the 'full name' parameter.\nThis vulnerability allows a remote, unauthenticated attacker to inject arbitrary malicious scripts into the web application, which are then executed within the context of a victim's browser session. Successful exploitation poses a significant security risk, as it enables the execution of unauthorized actions, theft of session cookies, session hijacking, or the defacement of the application's interface.\nGiven that the exploit has been publicly disclosed, the system is exposed to active exploitation attempts. Organizations utilizing this software are at high risk if they do not implement necessary remediations to sanitize user-supplied input.\nThe attack is remotely executable, requiring no prior authentication, and relies solely on the victim interacting with a crafted URL or request containing the malicious payload.",
  "technicalDetails": "The vulnerability is a reflected Cross-Site Scripting (XSS) flaw located in the /drug_recommender/index.php file of the SourceCodester Drug Recommendation System 1.0.\nThe root cause of this vulnerability is the application's failure to properly sanitize and encode user-supplied input provided through the 'full name' argument before reflecting it back to the user's browser in the HTTP response.\nThe application processes input from the 'full name' parameter and embeds it directly into the HTML document returned to the client without appropriate context-aware output escaping (e.g., HTML entity encoding). This allows an attacker to inject JavaScript payloads.\nThe attack flow proceeds as follows: 1) The attacker constructs a malicious URL containing a JavaScript payload within the 'full name' parameter. 2) The attacker lures an unsuspecting user to click this link or triggers a request to the server with the malicious parameter. 3) The server processes the request and embeds the unvalidated, malicious payload directly into the HTML response document. 4) Upon receiving the response, the victim's browser interprets the injected string as executable code rather than plain text. 5) The browser executes the malicious script under the security context of the vulnerable domain.\nBecause the payload is reflected directly in the HTML response, any scripts embedded by the attacker will execute with the same permissions as the application, allowing for the manipulation of DOM elements, theft of session identifiers (Session Hijacking), redirection to malicious external sites, or performing actions on behalf of the user without their consent.\nThe vulnerability is accessible remotely via the internet and does not require the attacker to have administrative or user-level privileges on the application. The exploitation is strictly a client-side execution that relies on the application's failure to secure the input reflection point.\nThe lack of appropriate Content Security Policy (CSP) headers further exacerbates the impact of this vulnerability, as there are no browser-side defenses to restrict the source or nature of the executed scripts, providing an attacker with broad capabilities once the payload is reflected."
}