Drug Recommendation System EUVD-2026-92179

Requires an authenticated administrator session on the Drug Recommendation System admin interface, specifically access to the Admin/add_user.php user-management function (consistent with PR:H). The weakness is triggered when a password is submitted through this Password Handler, which fails to encrypt the sensitive value. Limiting factors: high-privilege admin access is mandatory, the impact is confined to confidentiality of stored password data (VI:N/VA:N), and the product is a niche application, so there is no unauthenticated or default-configuration exposure.

This is a low-priority, high-noise issue rather than a genuine threat. The vendor-supplied CVSS 4.0 base score is only 2.0, and the vector (AV:N/AC:L/PR:H/UI:N/VC:L with VI:N/VA:N) describes a confidentiality-only weakness requiring high privileges (PR:H) - i.e. the actor must already be an authenticated administrator using Admin/add_user.php. The flaw (CWE-310, missing encryption of sensitive data) means passwords are stored/handled without proper encryption, so the 'attack' is really a post-authentication data-at-rest weakness, not a remote compromise. Exploitation signals are weak: a public proof-of-concept exists (E:P in the vector), but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of real-world or widespread exploitation. The product itself is an obscure SourceCodester demo application, further limiting real-world impact. Note a tension between the 'launch the attack remotely' phrasing and PR:H: the network vector only matters because the admin panel is web-accessible, but privileged access is still a hard prerequisite - this is not an unauthenticated remote issue.

An authenticated administrator (or an attacker who has already obtained admin credentials) uses the Admin/add_user.php user-creation function; because the Password Handler stores the supplied password without proper encryption (CWE-310), the credential is retained in cleartext/weakly-protected form in the backend. A public exploit has been released, but exploitation yields only limited confidentiality exposure of stored password data and requires existing high-privilege access.