CVE-2026-105175: SQL Injection in SourceCodester Drug Recommendation System

This vulnerability in SourceCodester Drug Recommendation System 1.0 arises from improper sanitization of the cmdschool parameter in the /Auth/add_student.php script within the Student Registration component. An attacker can remotely manipulate this parameter to perform SQL injection, potentially compromising the underlying database. The vulnerability is publicly known and has a CVSS 4.0 base score of 6.9, indicating a medium severity risk. No vendor advisory or patch information is provided, and no active exploitation has been confirmed.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, and no privilege or user interaction is required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the cmdschool parameter. Additionally, review and harden input validation and parameter sanitization in the affected component.