Drug Recommendation System EUVD-2026-92163

Exploitation requires an authenticated session with administrator privileges (PR:H), because the vulnerable endpoint is the admin-only Symptom Creation page /Admin/add_symptom.php; the attacker then supplies a malicious value in the txtname parameter. No user interaction is needed (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L), but the admin-authentication prerequisite is the primary limiting factor - an unauthenticated or low-privilege user cannot reach the vulnerable code path. There is no indication a non-default configuration is required; the flaw appears present in the default Drug Recommendation System 1.0 admin workflow.

This is a genuine but comparatively low-priority vulnerability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L) scores 5.1 (Medium), and the key limiting signal is PR:H - exploitation requires high (administrator) privileges, consistent with the vulnerable endpoint living under /Admin/add_symptom.php. The E:P temporal metric and the description both confirm publicly available exploit code exists, which raises opportunistic risk, but this is POC availability, NOT active exploitation - the CVE is not in CISA KEV and no EPSS score was supplied, so there is no evidence of widespread or automated exploitation. The combination of an attacker-controllable-only-after-admin-login SQL injection, low C/I/A impacts, and a niche affected product means this is a 'real-but-minor' issue rather than an urgent emergency. Note a tension worth flagging: a classic SQLi often warrants higher impact than VC:L/VI:L/VA:L, but because an authenticated admin already holds broad application access, the marginal confidentiality/integrity gain is genuinely limited, so the low impacts are defensible.

An attacker who has already authenticated to the application's admin panel submits a crafted value in the txtname parameter of /Admin/add_symptom.php, which is passed unsafely into a SQL query via mysqli_real_escape_string, injecting attacker-controlled SQL. A public exploit has been released, so a low-skill actor with valid or compromised admin credentials can reproduce the attack and read or modify backend database contents. Because it is network-reachable (AV:N) with low complexity (AC:L), exploitation is trivial once admin access is obtained.