EUVD-2026-92949
GHSA-7r9w-xfrf-wvw2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed web application
-
ExploitTamper with user_id parameter
-
ExecutionBypass Auth Guard authentication check
-
ImpactAccess or act as another user's account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to tamper with the user_id argument processed by the application's Auth Guard component, causing it to trust an attacker-supplied identity (classic parameter-based broken access control). Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no user interaction, and no special configuration are needed - any network-reachable instance of Drug Recommendation System 1.0 in its default state is exploitable. The main limiting factors are the product's very small real-world footprint and the capped LOW confidentiality/integrity/availability impact (VC:L/VI:L/VA:L), which bounds what a successful attack actually yields. |
| Impact | This is an improper authentication / broken access control flaw (CWE-287) in SourceCodester Drug Recommendation System 1.0, reachable remotely by manipulating the user_id argument in the Auth Guard component. The only provided CVSS is a 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with uniformly LOW technical impact (VC:L/VI:L/VA:L, no subsequent-system impact), yielding a moderate 6.9 score - the network vector and lack of required privileges or user interaction raise accessibility, but the impact ceiling is deliberately capped at low. The E:P (Proof-of-Concept) exploit maturity aligns with the input signal that public exploit code exists (a GitHub broken-access-control writeup), so this is NOT merely theoretical. However, there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active, widespread exploitation; the EPSS/KEV data is simply absent rather than contradictory. Net: real and easy to exploit against any exposed instance, but the practical risk is bounded by the product's near-zero enterprise footprint and the low per-event impact, making this a low-priority issue for most organizations despite the moderate CVSS and available POC. No CVSS 3.1 vector was supplied - the 4.0 vector is the only authoritative scoring input. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a request to the application with a tampered user_id value, causing the Auth Guard component to authenticate or authorize the request as another user without valid credentials. A public proof-of-concept documenting this broken access control is available on GitHub, lowering the skill barrier to reproduce it against any internet-exposed instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Authentication bypass in SourceCodester Drug Recommendation System 1.0 lets remote, unauthenticated attackers impersonate arbitrary accounts by manipulating the user_id argument processed by the application's Auth Guard component. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no credentials, user interaction, or special configuration are required, so any network-reachable default installation is exposed; impact is bounded to LOW confidentiality, integrity, and availability (VC:L/VI:L/VA:L), limiting the attacker to unauthorized read/limited modification rather than full system compromise. Publicly available exploit code exists, including a detailed GitHub write-up of the broken access control issue, so exploitation is trivial for anyone who can reach the instance; the practical risk is tempered mainly by the product's very small real-world deployment footprint and the capped impact ratings.
RemediationAI
No vendor-released patch was identified at time of analysis, and SourceCodester releases are distributed as source code on https://www.sourcecodester.com/, so remediation must currently be applied by the deployer. The core fix is to stop trusting the client-supplied user_id argument in the Auth Guard: derive the acting identity exclusively from a server-side session (e.g., $_SESSION['user_id'] set at successful login) and reject or ignore any user_id supplied in request parameters, cookies, or headers, then re-validate authorization on every request that reads or writes user-specific records. Until code is corrected, the most effective compensating control is to remove the application from untrusted network exposure - bind it to localhost or place it behind a VPN or an authenticating reverse proxy and restrict access to trusted users, accepting the trade-off that it becomes unusable for public/remote users. Additionally, review web server logs for requests that pass user_id values inconsistent with the authenticated session (an indicator of exploitation), and treat any data served to or modified by an impersonated identity as potentially exposed. There is no configuration toggle that disables the vulnerable Auth Guard without breaking the application's functionality, so code-level correction or network isolation are the only reliable options; consult the VulDB entry (https://vuldb.com/vuln/413697) and the public advisory (https://github.com/hackliu/Vulnerability-Reports/blob/master/Drug-Recommender-Web-App/VULN-02-Broken-Access-Control.md) for reproduction details that can guide testing of a fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a textbook instance of CWE-287 (Improper Authentication) manifesting as parameter-based broken access control. The application appears to be a PHP/MySQL web application in which an 'Auth Guard' routine decides whether the current request belongs to a legitimate authenticated user; rather than binding identity to server-side session state, the guard trusts a client-supplied user_id argument. An attacker can therefore set or alter user_id in the request and have the application treat them as that identity, bypassing the login/authorization check entirely. The CPE entry cpe:2.3:a:sourcecodester:drug_recommendation_system:*:*:*:*:*:*:*:* identifies the affected product as SourceCodester's Drug Recommendation System, with the wildcard version field indicating the issue is reported against the codebase rather than a specific patched revision (described as version 1.0). The CVSS 4.0 vector's AT:N and PR:N values confirm no attack prerequisites or prior authentication, while the LOW base metrics indicate the compromise yields limited data disclosure and modification, consistent with the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Vulnerability details were submitted through VulDB and documented by the researcher in a public GitHub advisory.
Know when Drug Recommendation System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote parameter tampering needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); impersonating another user yields only limited data access/modification, so C/I/A each Low and scope Unchanged.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the component Auth Guard. Such manipulation of the argument user_id leads to improper authentication. The attack can be executed remotely. The exploit is publicly available and might be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Drug Recommendation System
View allSQL injection in SourceCodester Drug Recommendation System 1.0 lets a remote attacker manipulate the SQL query behind /d
SQL injection in SourceCodester Drug Recommendation System 1.0 allows remote attackers to manipulate the ID parameter in
Cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows unauthenticated remote attackers to inject
Cross-site scripting (XSS) in SourceCodester Drug Recommendation System 1.0 allows remote attackers to inject malicious
Cross-site request forgery in SourceCodester Drug Recommendation System 1.0 allows a remote attacker to make an authenti
Stored cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows an authenticated user with access to
Stored cross-site scripting in the admin symptom-management form (drug_recommender/Admin/add_symptom) of SourceCodester
SQL injection in SourceCodester Drug Recommendation System 1.0 allows unauthenticated remote attackers to execute arbitr
Cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows remote, unauthenticated attackers to inject
Stored cross-site scripting in SourceCodester Drug Recommendation System 1.0 lets unauthenticated remote attackers injec
SQL injection in SourceCodester Drug Recommendation System 1.0 allows an authenticated administrator to inject arbitrary
SQL injection in the admin Drug Creation routine of SourceCodester Drug Recommendation System 1.0 lets an attacker with
Exploit-DB