SourceCodester Drug Recommendation System 1.0 contains a cross-site scripting vulnerability in an unknown function of /drug_recommender/index.php. An attacker can manipulate the 'full name' input parameter to inject malicious scripts, which execute in the context of the victim's browser. The vulnerability is remotely exploitable without privileges or authentication but requires user interaction. The exploit has been publicly disclosed, increasing the risk of exploitation.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction and does not grant direct system access or privilege escalation. The medium CVSS score reflects moderate impact primarily on confidentiality and integrity at the client side.

No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with the application and consider implementing web application firewall (WAF) rules to detect and block malicious input targeting the 'full name' parameter.