CVE-2026-105177: SQL Injection in SourceCodester Drug Recommendation System

This vulnerability exists in SourceCodester Drug Recommendation System 1.0 within an unknown function of /Admin/add_drug.php related to Drug Creation. Manipulating the arguments txtname, cmdtype, txtusage, txtsideeffect, or cmdcontraindication allows an attacker to perform SQL injection. The attack vector is remote network access with low attack complexity and no user interaction required. The vulnerability has a CVSS 4.0 score of 5.1 (medium severity). Exploit code is publicly available, but no vendor patch or remediation details are provided.

Successful exploitation could allow an attacker with high privileges to execute SQL injection attacks remotely, potentially leading to unauthorized data access or modification with low confidentiality, integrity, and availability impact as per CVSS vector. The presence of publicly available exploit code increases the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected component and validate or sanitize all user inputs related to the vulnerable parameters to mitigate SQL injection risks.