EUVD-2026-83736
GHSA-5f6c-rqhv-4943
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Admin/edit_user.php endpoint
-
ExploitInject SQL via ID parameter
-
ExecutionBackend executes tainted query
-
ImpactExtract or alter database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the ability to send a request to /drug_recommender/Admin/edit_user.php with a manipulated ID parameter in SourceCodester Drug Recommendation System 1.0. The /Admin/ path placement indicates the endpoint is intended for administrative users, so exploitation most likely requires an authenticated admin session (or an installation lacking access control on admin pages) - the vendor's unauthenticated (PR:N) claim is not consistent with this path and limits the realistic unauthenticated attack surface. No user interaction is required and the attack is remotely launchable once the endpoint is reachable. |
| Impact | This is a classic high-CVSS-number-but-low-real-priority issue. The vendor CVSS 4.0 score of 6.9 is inflated primarily by the PR:N (unauthenticated) and AV:N (network) claims combined with SQL injection, but the three impact metrics are all rated Low (VC:L/VI:L/VA:L), signaling limited assessed damage. The SSVC/threat signal E:P ('Proof-of-Concept') and the publicly available exploit code on GitHub confirm exploitability but NOT active exploitation - there is no CISA KEV listing and no EPSS score provided. Notably, the affected file resides under /drug_recommender/Admin/, which strongly implies an authenticated administrative context (PR:L), directly conflicting with the vendor's PR:N; this discrepancy should be verified. If the ID parameter is genuinely injectable, real-world impact for a SQLi is typically far higher than VC:L - full database extraction (VC:H) is realistic - so the impact metrics are arguably understated even as the auth requirement is likely understated in the opposite direction. Net: low operational priority due to the obscure, hobby-grade product footprint, not because the flaw is benign. |
| Exploit ScenarioDerived | An attacker reaches the Drug Recommendation System's admin edit-user page and supplies a crafted ID parameter to /drug_recommender/Admin/edit_user.php, injecting SQL that the backend concatenates unsanitized into a query. Public proof-of-concept exploit code exists (GitHub KaranParelkar/Drug_recommendation_system), lowering the skill barrier. Because the endpoint sits under an /Admin/ path, realistic exploitation likely requires an admin session or an application that fails to enforce access control on that path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
SQL injection in SourceCodester Drug Recommendation System 1.0 lets a remote attacker manipulate the SQL query behind /drug_recommender/Admin/edit_user.php by tampering with the ID parameter, enabling unauthorized read and modification of backend data. The vulnerability carries a publicly available exploit (proof-of-concept published on GitHub), so exploitation is trivial for anyone who can reach the endpoint, though no confirmed active exploitation (CISA KEV) has been reported. Scoring is split: the CNA/VulDB vector rates it CVSS 4.0 at 6.9 with PR:N, while our independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, because the /Admin/ path strongly suggests an authenticated administrative session is normally required, which markedly reduces the realistic attack surface and real-world priority despite the alarming-looking technical impact.
RemediationAI
No vendor-released patch has been identified at time of analysis; the source is a public sample project on SourceCodester and no fixed version (for example, a 1.0.1 tag or commit) has been published in the supplied references, so remediation must be self-imposed. The definitive code fix is to replace string concatenation of the ID argument in /drug_recommender/Admin/edit_user.php with a parameterized prepared statement (PDO or mysqli with bound parameters) and to cast the ID to an integer before use - this eliminates the SQL injection class entirely and has no functional side effects. Until code is fixed, compensating controls include enforcing authentication and role checks on every /drug_recommender/Admin/ page (which the /Admin/ path already implies but which the unauthenticated PR:N vector suggests may be missing on some installs), restricting network access to the admin directory via web server allow/deny rules or IP allow-listing, and deploying a WAF rule that rejects SQL metacharacters in the ID parameter - both of these are partial mitigations that add management overhead and can be bypassed by encoded payloads. Note that the public proof-of-concept at https://github.com/KaranParelkar/Drug_recommendation_system/blob/main/sqli/edit_user/Readme.md demonstrates the attack, so any internet-reachable instance should be patched or taken offline promptly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a PHP-based web application, SourceCodester Drug Recommendation System 1.0, distributed as a learning/CRUD sample project and matched by the CPE cpe:2.3:a:sourcecodester:drug_recommendation_system:*:*:*:*:*:*:*:*. The flaw is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command, i.e., SQL injection) in the admin user-editing script edit_user.php, where the ID argument is concatenated into a SQL statement without parameterization or sanitization. Because the request flows directly from the HTTP layer into the database, an attacker who can supply a crafted ID value can alter query logic, with potential read and write exposure to user records depending on DB privileges of the application account. The underlying issue class is well understood and entirely preventable through prepared statements and strict input typing of numeric identifiers; the fact that the ID parameter is treated as free-form string input is the root cause.
Know when Drug Recommendation System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Admin-path endpoint implies authenticated access (PR:L); SQLi enables full database read and modification (C:H/I:H), no availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file /drug_recommender/Admin/edit_user.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Drug Recommendation System
View allAuthentication bypass in SourceCodester Drug Recommendation System 1.0 lets remote, unauthenticated attackers impersonat
SQL injection in SourceCodester Drug Recommendation System 1.0 allows remote attackers to manipulate the ID parameter in
Cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows unauthenticated remote attackers to inject
Cross-site scripting (XSS) in SourceCodester Drug Recommendation System 1.0 allows remote attackers to inject malicious
Cross-site request forgery in SourceCodester Drug Recommendation System 1.0 allows a remote attacker to make an authenti
Stored cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows an authenticated user with access to
Stored cross-site scripting in the admin symptom-management form (drug_recommender/Admin/add_symptom) of SourceCodester
SQL injection in SourceCodester Drug Recommendation System 1.0 allows unauthenticated remote attackers to execute arbitr
Cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows remote, unauthenticated attackers to inject
Stored cross-site scripting in SourceCodester Drug Recommendation System 1.0 lets unauthenticated remote attackers injec
SQL injection in SourceCodester Drug Recommendation System 1.0 allows an authenticated administrator to inject arbitrary
SQL injection in the admin Drug Creation routine of SourceCodester Drug Recommendation System 1.0 lets an attacker with
Exploit-DB