Drug Recommendation System SQL Injection Flaws

SQL injection in SourceCodester Drug Recommendation System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the cmdschool parameter in /Auth/add_student.php. A public exploit has been released (publicly available exploit code exists; no evidence of active exploitation in CISA KEV) and the CVSS 4.0 base score is 6.9 (medium). The vulnerability is limited to low confidentiality, integrity, and availability impact, and real-world risk is low because the application is a niche academic/demo PHP project rarely exposed to the internet.

SourceCodester Drug Recommendation System 1.0 does not encrypt passwords submitted through the Password Handler in Admin/add_user.php, so an authenticated administrator can cause sensitive password data to be handled without cryptographic protection. Exploitation requires a high-privilege admin session (PR:H) and yields only low confidentiality impact, and the independent assessment classifies this as a low-priority, high-noise issue rather than a genuine threat. Publicly available exploit code exists, but no confirmed active exploitation is indicated by the supplied data.

SQL injection in SourceCodester Drug Recommendation System 1.0 allows an authenticated administrator to manipulate the ID parameter of /Admin/edit_class.php and execute arbitrary SQL against the underlying database. The vulnerability is network-reachable with low complexity but requires high privileges (PR:H), limiting practical exploitation to malicious insiders or attackers who have already compromised an admin account; a publicly available exploit code exists, though no active exploitation has been confirmed. Given the niche product and the high-privilege precondition, this is a low-to-moderate priority issue that is unlikely to warrant emergency patching in most environments.

SQL injection in the admin Drug Creation routine of SourceCodester Drug Recommendation System 1.0 lets an attacker with an existing administrator session read and tamper with the application's database by submitting crafted values through the txtname, cmdtype, txtusage, txtsideeffect, or cmdcontraindication parameters of /Admin/add_drug.php. The hard prerequisite is prior admin-level access (CVSS PR:H / the assessed CVSS:3.1 vector PR:H), so this is not exploitable by an anonymous remote user against a default installation, and impact is bounded to partial confidentiality, integrity and availability of the application database. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P), although there is no indication of confirmed active exploitation (not in CISA KEV), and the issue should be treated as low-to-moderate priority relative to the SQL injection classification.

SQL injection in SourceCodester Drug Recommendation System 1.0 allows an authenticated administrator to inject arbitrary SQL through the txtname parameter on the admin-only Symptom Creation page (/Admin/add_symptom.php), corrupting or disclosing the underlying MySQL database. The flaw stems from improper use of mysqli_real_escape_string during query construction (CWE-89), and because the vulnerable endpoint sits behind the admin login (CVSS PR:H), an attacker must first hold administrator credentials; the assessed impact is limited confidentiality, integrity, and availability loss (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists and has been published, elevating practical risk for any deployment where admin credentials are weak, shared, or exposed, but this is not an unauthenticated or pre-auth remote compromise and should be treated as a comparatively low-priority finding.