CVE-2026-105178: SQL Injection in SourceCodester Drug Recommendation System

This vulnerability exists in SourceCodester Drug Recommendation System 1.0 within the Symptom Creation feature. The issue arises from improper handling of the txtname parameter in the mysqli_real_escape_string function in /Admin/add_symptom.php, enabling SQL injection attacks. The flaw can be exploited remotely by attackers with high privileges. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, no user interaction, but requiring high privileges. The vulnerability has been publicly disclosed along with a released exploit.

Successful exploitation could allow an attacker with high privileges to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the requirement for high privileges and the low confidentiality, integrity, and availability impacts noted in the CVSS vector.

No official patch or remediation has been provided by the vendor as of the published date. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable functionality to trusted users only and monitor for suspicious activity related to the txtname parameter.