Drug Recommendation System
Monthly
Stored cross-site scripting in SourceCodester Drug Recommendation System 1.0 lets unauthenticated remote attackers inject arbitrary script through the name or email argument handled by Admin/user_record.php, which then executes in the browser session of an administrator viewing the Admin Record Tables page. Publicly available exploit code exists, and no vendor-released patch has been identified, though CVSS 4.0 scoring of 5.3 with UI:P reflects that a privileged victim must passively render the tainted record before the payload fires. This is a genuinely low-priority issue despite being publicly disclosed, because impact is confined to script execution in the viewing user's browser (integrity-low) with no direct server compromise.
Cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows remote, unauthenticated attackers to inject script payloads into the Student Registration workflow at Auth/add_student.php via the txtname, txtpassword, txtemail, txtphone and txtprevious_school fields. Publicly available exploit code exists (CVSS 4.0 E:P, CVSS 3.1 base 5.3) and the injected script executes only when a victim - plausibly an administrator reviewing submitted registration records - renders the tainted output in a browser, so impact is bounded to that victim's browser session within the application. Exploitation is not confirmed actively exploited (not in CISA KEV), and no vendor-released patch was identified at time of analysis, making this a low-to-moderate priority issue despite the public exploit.
Cross-site request forgery in SourceCodester Drug Recommendation System 1.0 allows a remote attacker to make an authenticated victim's browser submit unintended state-changing requests, because the application's forms do not validate anti-CSRF tokens (CWE-352). The attacker needs no credentials of their own (CVSS:3.1 AV:N/AC:L/PR:N/UI:R/S:U), but success requires luring a logged-in victim to attacker-controlled content while their session is active, and the resulting impact is limited to low integrity with no confidentiality or availability loss. Publicly available exploit code exists (published in the hackliu/Vulnerability-Reports repository as VULN-06-CSRF-Missing-Tokens.md), but there is no evidence of confirmed active exploitation (not listed in CISA KEV), so this should be treated as a low-to-moderate real-world risk rather than a mass-exploitation event.
Cross-site scripting (XSS) in SourceCodester Drug Recommendation System 1.0 allows remote attackers to inject malicious scripts via the Admin/add_drug.php endpoint, which execute in an authenticated administrator's browser when the drug data is rendered. The attack requires user interaction and typically administrator-level access to the vulnerable form, and while publicly available exploit code exists, the overall risk is assessed as low-to-moderate due to these prerequisites and the limited browser-context impact.
Authentication bypass in SourceCodester Drug Recommendation System 1.0 lets remote, unauthenticated attackers impersonate arbitrary accounts by manipulating the user_id argument processed by the application's Auth Guard component. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no credentials, user interaction, or special configuration are required, so any network-reachable default installation is exposed; impact is bounded to LOW confidentiality, integrity, and availability (VC:L/VI:L/VA:L), limiting the attacker to unauthorized read/limited modification rather than full system compromise. Publicly available exploit code exists, including a detailed GitHub write-up of the broken access control issue, so exploitation is trivial for anyone who can reach the instance; the practical risk is tempered mainly by the product's very small real-world deployment footprint and the capped impact ratings.
SQL injection in SourceCodester Drug Recommendation System 1.0 allows an authenticated administrator to inject arbitrary SQL through the txtname parameter on the admin-only Symptom Creation page (/Admin/add_symptom.php), corrupting or disclosing the underlying MySQL database. The flaw stems from improper use of mysqli_real_escape_string during query construction (CWE-89), and because the vulnerable endpoint sits behind the admin login (CVSS PR:H), an attacker must first hold administrator credentials; the assessed impact is limited confidentiality, integrity, and availability loss (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists and has been published, elevating practical risk for any deployment where admin credentials are weak, shared, or exposed, but this is not an unauthenticated or pre-auth remote compromise and should be treated as a comparatively low-priority finding.
SQL injection in the admin Drug Creation routine of SourceCodester Drug Recommendation System 1.0 lets an attacker with an existing administrator session read and tamper with the application's database by submitting crafted values through the txtname, cmdtype, txtusage, txtsideeffect, or cmdcontraindication parameters of /Admin/add_drug.php. The hard prerequisite is prior admin-level access (CVSS PR:H / the assessed CVSS:3.1 vector PR:H), so this is not exploitable by an anonymous remote user against a default installation, and impact is bounded to partial confidentiality, integrity and availability of the application database. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P), although there is no indication of confirmed active exploitation (not in CISA KEV), and the issue should be treated as low-to-moderate priority relative to the SQL injection classification.
SQL injection in SourceCodester Drug Recommendation System 1.0 allows an authenticated administrator to manipulate the ID parameter of /Admin/edit_class.php and execute arbitrary SQL against the underlying database. The vulnerability is network-reachable with low complexity but requires high privileges (PR:H), limiting practical exploitation to malicious insiders or attackers who have already compromised an admin account; a publicly available exploit code exists, though no active exploitation has been confirmed. Given the niche product and the high-privilege precondition, this is a low-to-moderate priority issue that is unlikely to warrant emergency patching in most environments.
SQL injection in SourceCodester Drug Recommendation System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the cmdschool parameter in /Auth/add_student.php. A public exploit has been released (publicly available exploit code exists; no evidence of active exploitation in CISA KEV) and the CVSS 4.0 base score is 6.9 (medium). The vulnerability is limited to low confidentiality, integrity, and availability impact, and real-world risk is low because the application is a niche academic/demo PHP project rarely exposed to the internet.
Cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows unauthenticated remote attackers to inject arbitrary script through the 'full name' argument processed by /drug_recommender/index.php, with the payload executing in a victim's browser once the unsanitized value is rendered. Publicly available exploit code exists - a GitHub proof-of-concept README documents the injection path (profile XSS) - but there is no evidence of confirmed active exploitation, and the vendor/analyst scoring places this at 5.3 (CVSS 4.0 AV:N/AC:L/PR:N/UI:P, with the independent assessment using CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting integrity-limited impact with no confidentiality or availability loss. Overall this is a low-to-moderate risk issue: it requires victim interaction and an internet-reachable deployment of an obscure PHP application unlikely to be exposed in production.
Stored cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows an authenticated user with access to the User Management add_user function to inject malicious script via the txtname, txtemail, or txtpassword parameters, which then executes in the browser of any user who views the affected page. Publicly available exploit code exists, though exploitation requires authentication (PR:L per the assessed CVSS 3.1 vector) and victim interaction (UI:P), and the target is a niche application with essentially no production deployment, making the real-world risk low. The assessed impact is limited to browser-context integrity (VI:L) with no confidentiality or availability effect.
Stored cross-site scripting in the admin symptom-management form (drug_recommender/Admin/add_symptom) of SourceCodester Drug Recommendation System 1.0 lets a user supply malicious content through the txtname argument that is later rendered in a browser without proper output encoding. The attack is remote but gated behind a high-privilege administrator account (CVSS PR:H) and requires a victim to view the affected admin page (UI:P/UI:R), which effectively restricts exploitation to the admin context - closer to self-XSS than a cross-privilege attack - and makes this a low real-world priority despite a public exploit. Publicly available exploit code exists (a GitHub PoC walkthrough linked from the CVE record); there is no indication of confirmed active exploitation (not in CISA KEV), and the independent assessment rates the overall real-world risk as low.
SQL injection in SourceCodester Drug Recommendation System 1.0 lets a remote attacker manipulate the SQL query behind /drug_recommender/Admin/edit_user.php by tampering with the ID parameter, enabling unauthorized read and modification of backend data. The vulnerability carries a publicly available exploit (proof-of-concept published on GitHub), so exploitation is trivial for anyone who can reach the endpoint, though no confirmed active exploitation (CISA KEV) has been reported. Scoring is split: the CNA/VulDB vector rates it CVSS 4.0 at 6.9 with PR:N, while our independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, because the /Admin/ path strongly suggests an authenticated administrative session is normally required, which markedly reduces the realistic attack surface and real-world priority despite the alarming-looking technical impact.
SQL injection in SourceCodester Drug Recommendation System 1.0 allows remote attackers to manipulate the ID parameter in /Admin/edit_symptom.php, causing the application to execute attacker-influenced SQL against its backend database and potentially read or alter symptom records. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation; independent assessment treats this as a lower real-world priority because the /Admin/ endpoint is normally protected by an admin login and the product's deployment base is very small. The vendor's CVSS 4.0 vector rates it 6.9 with PR:N, while the independent CVSS 3.1 assessment requires admin-level authentication (PR:L) and assigns high confidentiality and integrity impact with limited availability impact.
Stored cross-site scripting in SourceCodester Drug Recommendation System 1.0 lets unauthenticated remote attackers inject arbitrary script through the name or email argument handled by Admin/user_record.php, which then executes in the browser session of an administrator viewing the Admin Record Tables page. Publicly available exploit code exists, and no vendor-released patch has been identified, though CVSS 4.0 scoring of 5.3 with UI:P reflects that a privileged victim must passively render the tainted record before the payload fires. This is a genuinely low-priority issue despite being publicly disclosed, because impact is confined to script execution in the viewing user's browser (integrity-low) with no direct server compromise.
Cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows remote, unauthenticated attackers to inject script payloads into the Student Registration workflow at Auth/add_student.php via the txtname, txtpassword, txtemail, txtphone and txtprevious_school fields. Publicly available exploit code exists (CVSS 4.0 E:P, CVSS 3.1 base 5.3) and the injected script executes only when a victim - plausibly an administrator reviewing submitted registration records - renders the tainted output in a browser, so impact is bounded to that victim's browser session within the application. Exploitation is not confirmed actively exploited (not in CISA KEV), and no vendor-released patch was identified at time of analysis, making this a low-to-moderate priority issue despite the public exploit.
Cross-site request forgery in SourceCodester Drug Recommendation System 1.0 allows a remote attacker to make an authenticated victim's browser submit unintended state-changing requests, because the application's forms do not validate anti-CSRF tokens (CWE-352). The attacker needs no credentials of their own (CVSS:3.1 AV:N/AC:L/PR:N/UI:R/S:U), but success requires luring a logged-in victim to attacker-controlled content while their session is active, and the resulting impact is limited to low integrity with no confidentiality or availability loss. Publicly available exploit code exists (published in the hackliu/Vulnerability-Reports repository as VULN-06-CSRF-Missing-Tokens.md), but there is no evidence of confirmed active exploitation (not listed in CISA KEV), so this should be treated as a low-to-moderate real-world risk rather than a mass-exploitation event.
Cross-site scripting (XSS) in SourceCodester Drug Recommendation System 1.0 allows remote attackers to inject malicious scripts via the Admin/add_drug.php endpoint, which execute in an authenticated administrator's browser when the drug data is rendered. The attack requires user interaction and typically administrator-level access to the vulnerable form, and while publicly available exploit code exists, the overall risk is assessed as low-to-moderate due to these prerequisites and the limited browser-context impact.
Authentication bypass in SourceCodester Drug Recommendation System 1.0 lets remote, unauthenticated attackers impersonate arbitrary accounts by manipulating the user_id argument processed by the application's Auth Guard component. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no credentials, user interaction, or special configuration are required, so any network-reachable default installation is exposed; impact is bounded to LOW confidentiality, integrity, and availability (VC:L/VI:L/VA:L), limiting the attacker to unauthorized read/limited modification rather than full system compromise. Publicly available exploit code exists, including a detailed GitHub write-up of the broken access control issue, so exploitation is trivial for anyone who can reach the instance; the practical risk is tempered mainly by the product's very small real-world deployment footprint and the capped impact ratings.
SQL injection in SourceCodester Drug Recommendation System 1.0 allows an authenticated administrator to inject arbitrary SQL through the txtname parameter on the admin-only Symptom Creation page (/Admin/add_symptom.php), corrupting or disclosing the underlying MySQL database. The flaw stems from improper use of mysqli_real_escape_string during query construction (CWE-89), and because the vulnerable endpoint sits behind the admin login (CVSS PR:H), an attacker must first hold administrator credentials; the assessed impact is limited confidentiality, integrity, and availability loss (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists and has been published, elevating practical risk for any deployment where admin credentials are weak, shared, or exposed, but this is not an unauthenticated or pre-auth remote compromise and should be treated as a comparatively low-priority finding.
SQL injection in the admin Drug Creation routine of SourceCodester Drug Recommendation System 1.0 lets an attacker with an existing administrator session read and tamper with the application's database by submitting crafted values through the txtname, cmdtype, txtusage, txtsideeffect, or cmdcontraindication parameters of /Admin/add_drug.php. The hard prerequisite is prior admin-level access (CVSS PR:H / the assessed CVSS:3.1 vector PR:H), so this is not exploitable by an anonymous remote user against a default installation, and impact is bounded to partial confidentiality, integrity and availability of the application database. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P), although there is no indication of confirmed active exploitation (not in CISA KEV), and the issue should be treated as low-to-moderate priority relative to the SQL injection classification.
SQL injection in SourceCodester Drug Recommendation System 1.0 allows an authenticated administrator to manipulate the ID parameter of /Admin/edit_class.php and execute arbitrary SQL against the underlying database. The vulnerability is network-reachable with low complexity but requires high privileges (PR:H), limiting practical exploitation to malicious insiders or attackers who have already compromised an admin account; a publicly available exploit code exists, though no active exploitation has been confirmed. Given the niche product and the high-privilege precondition, this is a low-to-moderate priority issue that is unlikely to warrant emergency patching in most environments.
SQL injection in SourceCodester Drug Recommendation System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the cmdschool parameter in /Auth/add_student.php. A public exploit has been released (publicly available exploit code exists; no evidence of active exploitation in CISA KEV) and the CVSS 4.0 base score is 6.9 (medium). The vulnerability is limited to low confidentiality, integrity, and availability impact, and real-world risk is low because the application is a niche academic/demo PHP project rarely exposed to the internet.
Cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows unauthenticated remote attackers to inject arbitrary script through the 'full name' argument processed by /drug_recommender/index.php, with the payload executing in a victim's browser once the unsanitized value is rendered. Publicly available exploit code exists - a GitHub proof-of-concept README documents the injection path (profile XSS) - but there is no evidence of confirmed active exploitation, and the vendor/analyst scoring places this at 5.3 (CVSS 4.0 AV:N/AC:L/PR:N/UI:P, with the independent assessment using CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting integrity-limited impact with no confidentiality or availability loss. Overall this is a low-to-moderate risk issue: it requires victim interaction and an internet-reachable deployment of an obscure PHP application unlikely to be exposed in production.
Stored cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows an authenticated user with access to the User Management add_user function to inject malicious script via the txtname, txtemail, or txtpassword parameters, which then executes in the browser of any user who views the affected page. Publicly available exploit code exists, though exploitation requires authentication (PR:L per the assessed CVSS 3.1 vector) and victim interaction (UI:P), and the target is a niche application with essentially no production deployment, making the real-world risk low. The assessed impact is limited to browser-context integrity (VI:L) with no confidentiality or availability effect.
Stored cross-site scripting in the admin symptom-management form (drug_recommender/Admin/add_symptom) of SourceCodester Drug Recommendation System 1.0 lets a user supply malicious content through the txtname argument that is later rendered in a browser without proper output encoding. The attack is remote but gated behind a high-privilege administrator account (CVSS PR:H) and requires a victim to view the affected admin page (UI:P/UI:R), which effectively restricts exploitation to the admin context - closer to self-XSS than a cross-privilege attack - and makes this a low real-world priority despite a public exploit. Publicly available exploit code exists (a GitHub PoC walkthrough linked from the CVE record); there is no indication of confirmed active exploitation (not in CISA KEV), and the independent assessment rates the overall real-world risk as low.
SQL injection in SourceCodester Drug Recommendation System 1.0 lets a remote attacker manipulate the SQL query behind /drug_recommender/Admin/edit_user.php by tampering with the ID parameter, enabling unauthorized read and modification of backend data. The vulnerability carries a publicly available exploit (proof-of-concept published on GitHub), so exploitation is trivial for anyone who can reach the endpoint, though no confirmed active exploitation (CISA KEV) has been reported. Scoring is split: the CNA/VulDB vector rates it CVSS 4.0 at 6.9 with PR:N, while our independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, because the /Admin/ path strongly suggests an authenticated administrative session is normally required, which markedly reduces the realistic attack surface and real-world priority despite the alarming-looking technical impact.
SQL injection in SourceCodester Drug Recommendation System 1.0 allows remote attackers to manipulate the ID parameter in /Admin/edit_symptom.php, causing the application to execute attacker-influenced SQL against its backend database and potentially read or alter symptom records. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation; independent assessment treats this as a lower real-world priority because the /Admin/ endpoint is normally protected by an admin login and the product's deployment base is very small. The vendor's CVSS 4.0 vector rates it 6.9 with PR:N, while the independent CVSS 3.1 assessment requires admin-level authentication (PR:L) and assigns high confidentiality and integrity impact with limited availability impact.