Drug Recommendation System EUVD-2026-92161

Exploitation requires authenticated administrative access to the application, because the vulnerable endpoint resides under the /Admin/ path (edit_class.php) and the CVSS 4.0 vector specifies PR:H. The attacker then supplies a malicious value in the ID parameter of the edit_class.php request; no user interaction is needed (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L). The primary limiting factor is the high-privilege precondition - a non-admin cannot reach this code path - which sharply narrows the realistic threat to insider misuse or post-compromise lateral actions rather than unauthenticated internet-wide attacks. Product footprint (a niche SourceCodester application, version 1.0) further limits practical exposure.

This is a low-to-moderate priority issue that is unlikely to warrant emergency patching in most environments. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L) scores only 5.1 and critically requires PR:H - high privileges. Because the vulnerable endpoint is /Admin/edit_class.php, an attacker must already hold administrative access, which drastically limits real-world exploitability since an admin can typically already manipulate the underlying data directly. Exploitation signals are mixed: a public exploit has been disclosed (E:P in the vector and the description both confirm POC availability), but there is NO CISA KEV listing and NO EPSS score was provided in the input, so there is no evidence of active or widespread exploitation. The 'E:P' (Proof-of-Concept) exploit maturity aligns with publicly available exploit code rather than weaponized in-the-wild use. The combination of a self-hosted hobby PHP application, a required admin precondition, and only Low (partial) impact to confidentiality, integrity, and availability means this is a high-CVSS-relative-to-product but genuinely low-real-risk issue for the broader internet. No key signals conflict with each other, though the absence of EPSS/KEV data means exploitation likelihood must be inferred from POC existence alone.

An authenticated administrator (or an attacker who has already compromised an admin session via other means) sends a crafted value in the ID parameter to /Admin/edit_class.php, injecting SQL that is executed against the backend database. A public proof-of-concept exists, so the injection string is already documented and trivially reusable. Because network attack vector and low complexity apply, the request can be issued remotely once valid admin credentials or a session are obtained.