Drug Recommendation System EUVD-2026-92162

Exploitation requires an authenticated administrator session (PR:H) because the vulnerable endpoint /Admin/add_drug.php is part of the admin-only Drug Creation component; the attacker must reach the add-drug form and supply crafted input in the txtname, cmdtype, txtusage, txtsideeffect, or cmdcontraindication POST parameters. No user interaction by a victim is needed (UI:N) and the attack is network-remote (AV:N), but the hard limiting factor is that prior admin-level access is mandatory - this is not exploitable by an anonymous remote user against a default configuration. Impact is bounded to LOW (partial read/write of the application database), not full server compromise.

This is a low-to-moderate priority issue despite the SQL injection classification. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) indicates network-reachable, low-complexity exploitation but requires HIGH privileges (PR:H) - the vulnerable endpoint /Admin/add_drug.php sits inside the administrative panel, so an attacker must already hold admin-level access, which sharply limits real-world risk. Impact is rated LOW across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), not a full database takeover, yielding a modest 5.1 (Medium) base score. The E:P temporal flag and the description ('exploit is publicly available') confirm publicly available exploit code exists, but there is NO CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation. The signals are internally consistent: a credentialed SQLi with limited impact in niche software. The dominant mitigating factor is the PR:H requirement - an unauthenticated attacker cannot reach this. No EPSS data was supplied, so exploitation probability cannot be quantified from the input.

An attacker who has already obtained administrator credentials to the Drug Recommendation System logs into the admin panel and navigates to the drug creation feature. They submit the add-drug form with a malicious SQL payload in one of the txtname, cmdtype, txtusage, txtsideeffect, or cmdcontraindication parameters, causing the backend query to be manipulated to read or alter database contents. Public exploit code for this parameter injection is available, lowering the skill required to reproduce the attack.