Drug Recommendation System CVE-2026-93997

Requires the ability to send an HTTP request to the admin page /Admin/edit_symptom.php with a manipulated ID parameter on a deployed SourceCodester Drug Recommendation System 1.0 instance. The primary limiting factor is that the endpoint resides in the /Admin/ directory, which is typically protected by an admin login - if that gate is enforced, exploitation requires prior administrative authentication despite the vendor's PR:N rating. No user interaction, no special non-default configuration, and no specific platform beyond a standard PHP/MySQL stack are needed. Real-world exposure is limited by the product's tiny, non-enterprise deployment base.

This is a classic high-CVSS-numerically-modest-but-low-real-priority issue. The vendor CVSS 4.0 base score is 6.9 (medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L and E:P (proof-of-concept exploit maturity), meaning the exploitation-corrected temporal picture is a publicly available PoC but no evidence of active, automated exploitation. No EPSS score and no CISA KEV listing were provided, so there is no signal of widespread or confirmed in-the-wild abuse - the PoC availability is the only exploitation signal. I dispute the vendor's confidentiality/integrity/availability impact ratings: a SQL injection into an admin backend typically yields full database read (credential/PII disclosure) rather than the VC:L/VI:L/VA:L 'Low' the vendor assigned, so real technical impact on the database is likely higher than the score implies. Conversely, the PR:N (unauthenticated) claim is questionable: the vulnerable file lives under /Admin/, which normally sits behind an admin authentication gate - verify with vendor/source whether edit_symptom.php is reachable pre-auth. Net: genuine SQLi with a public PoC, but the affected product is an obscure hobbyist application with negligible enterprise footprint, so this is a low operational priority for most organizations.

An attacker reaches the admin-side page /Admin/edit_symptom.php and supplies a crafted value in the ID parameter (e.g., a UNION-based or boolean/time-blind payload), which is concatenated unsanitized into a SQL query. A public PoC (GitHub KaranParelkar/Drug_recommendation_system) documents the exact ID-parameter injection, lowering the skill bar. Successful exploitation lets the attacker read or modify database contents, potentially dumping stored credentials or symptom/patient records.