Drug Recommendation System EUVD-2026-92160

Exploitation requires network access to a deployed instance of SourceCodester Drug Recommendation System 1.0 where the /Auth/add_student.php Student Registration endpoint is reachable; the attacker supplies a malicious value in the cmdschool parameter. Per the CVSS 4.0 vector (PR:N/UI:N), no authentication and no user interaction are required, and no non-default configuration is indicated - the registration endpoint appears exposed by default. The principal limiting factor is deployment scope: this is a niche academic/demo PHP application that is rarely run in production or exposed to the internet, which sharply reduces real-world reachability despite the favorable attack vector.

Signals are mostly consistent and point to a real but moderate-priority issue rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SQL injection, which is a genuinely attacker-favorable profile. However, impact is bounded: VC:L/VI:L/VA:L with no subsequent-system impact (SC:N/SI:N/SA:N) yields a base score of only 6.9 (Medium), reflecting limited partial impact to confidentiality, integrity, and availability rather than full database compromise or RCE. The exploit maturity metric E:P (Proof-of-Concept) aligns with the description stating public exploit code exists - publicly available exploit code exists. No CISA KEV listing and no EPSS score were provided, so there is no evidence of confirmed active exploitation; the presence of a POC is a distinct, lower signal than in-the-wild use. The dominant mitigating factor is the target: SourceCodester Drug Recommendation System is a small open-source PHP demo/academic application with negligible enterprise footprint, so despite the unauthenticated-remote vector the realistic blast radius is small. Net: treat as a routine Medium - patch or sanitize input where this code is deployed, but it is not a CVSS-inflated phantom nor a mass-exploitation priority.

A remote, unauthenticated attacker sends a crafted request to /Auth/add_student.php with a malicious payload in the cmdschool parameter, which is concatenated into a SQL query during student registration. Because public proof-of-concept exploit code exists and no authentication or user interaction is required, an attacker can extract or manipulate limited database contents (e.g., dumping credential or student records). The low attack complexity means the request can be delivered with a simple HTTP client or automated with sqlmap.