SourceCodester Drug Recommendation System 1.0 contains a SQL injection vulnerability in the /Admin/edit_symptom.php file. The vulnerability arises from improper sanitization of the ID parameter, allowing remote attackers to execute arbitrary SQL commands. This can lead to unauthorized data access or modification. The vulnerability is publicly known and exploitable remotely without authentication. No vendor patch or fix has been disclosed.

Successful exploitation of this SQL injection vulnerability could allow attackers to manipulate the backend database, potentially leading to unauthorized data disclosure, data modification, or other impacts depending on the database privileges. The vulnerability is remotely exploitable without user interaction or privileges, increasing its risk. However, no evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the affected parameter to mitigate SQL injection risks.