Drug Recommendation System EUVD-2026-92948

Exploitation targets the drug-add function exposed via Admin/add_drug.php in SourceCodester Drug Recommendation System 1.0, where user-supplied input is rendered without output encoding, enabling reflected and/or stored cross-site scripting. Limiting factors: (1) user interaction is required (UI:P) - a victim must view the page hosting the injected payload; (2) the vulnerable endpoint resides under the Admin/ directory, which in typical SourceCodester deployments sits behind an administrator login, so access to that form - or luring an authenticated admin to a crafted request - is likely a prerequisite despite the input vector's PR:N claim; (3) impact is confined to the browser context (no server-side confidentiality or availability impact).

This is a low-to-moderate priority issue despite public exploit availability. The CVSS 4.0 base score is 5.3 (Medium), reflecting limited impact: only integrity is affected at Low (VI:L) with no confidentiality (VC:N) or availability (VA:N) impact and no subsequent-system (scope) impact, consistent with a typical XSS payload executing in a victim's browser context. The signals are mixed: public exploit code exists (confirmed via VulDB/GitHub) and the CVSS marks exploitation as Proof-of-Concept (E:P), but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of widespread or automated exploitation - exploitation is opportunistic at most. A key conflict must be flagged: the input CVSS vector lists PR:N (no privileges required), yet the vulnerable file is Admin/add_drug.php, strongly implying the affected form sits behind an administrative panel; if authentication is required, real-world exploitability is materially lower than the PR:N vector suggests - verify the authentication requirement against the vendor/PoC. UI:P (passive user interaction) further limits exploitation, as a victim must be induced to view the injected content. Overall this reads as a high-CVSS-relative-to-real-risk issue for a niche product rather than a fleet-wide emergency.

An attacker submits a crafted payload through the add_drug.php form in the admin area; the application stores or reflects the input without proper output encoding (CWE-79), so when an administrator or user later views that content, attacker-controlled JavaScript executes in their browser. A public proof-of-concept documenting both reflected and stored XSS variants is available on GitHub, lowering the barrier to attack. Exploitation requires a victim to load the affected page (UI:P), and likely requires access to the admin add-drug function.