Skip to content
Threat Feed
Subscribe
high advisory

SQL Injection in SourceCodester Drug Recommendation System

SourceCodester Drug Recommendation System 1.0 is vulnerable to remote SQL injection via the ID argument in /Admin/edit_symptom.php, allowing unauthenticated attackers to manipulate backend database queries.

CVE search metadata

CVE search record: CVE-2026-93997. Severity: high. CVSS: 7.3. KEV: no. Product: Drug Recommendation System (1.0). Brief: SQL Injection in SourceCodester Drug Recommendation System. Brief link: https://feed.craftedsignal.io/briefs/2026-09-20-sourcecodester-sql-injection/

CVE search record: CVE-2026-94015. KEV: no. Product: Drug Recommendation System (1.0). Brief: SQL Injection in SourceCodester Drug Recommendation System. Brief link: https://feed.craftedsignal.io/briefs/2026-09-20-sourcecodester-sql-injection/

Triage facts

Revision 2
Applicability
Drug Recommendation System (1.0)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
2 public sources
Freshness
Revision 2Sep 20, 12:21 UTC
Detection
2 rules
Vulnerabilities
2 CVEs
Source quality
A1Likely
Revision history 1 entry · Revision 2
  1. Revision 2

    Repaired a legacy canonical identity collision

    Changed: slug

A SQL injection vulnerability has been identified in SourceCodester Drug Recommendation System version 1.0. The vulnerability resides within the /Admin/edit_symptom.php script, specifically affecting the handling of the 'ID' argument. This flaw allows remote, unauthenticated attackers to inject arbitrary SQL commands into the backend database. Publicly available exploit code exists, increasing the risk of unauthorized data access, modification, or complete database compromise. Organizations utilizing this software should restrict access to the administrative interface and review all application logs for anomalous SQL patterns originating from the /Admin/ directory.

Impact

Successful exploitation of this vulnerability permits remote attackers to execute arbitrary SQL queries against the application database. This can lead to the unauthorized disclosure of sensitive medical or system data, modification of existing records, or potentially administrative account takeover. Given the nature of the application as a drug recommendation system, the integrity of the data is critical.

Recommendation

  • Restrict access to the /Admin/ directory to known, authorized IP addresses via web server access control lists.
  • Deploy the provided Sigma rule to detect anomalous characters in the 'ID' parameter of the edit_symptom.php endpoint.
  • Audit database logs for unusual queries or UNION-based SQL injection patterns associated with the user account running the web application service.
  • Prioritize migration away from legacy, unsupported SourceCodester systems if patching is unavailable.

Immediate actions

Deploy Sigma detection rule to web application firewalls or SIEM

Detection Engineering 24h

Mitigations

Restrict external access to the /Admin/ directory

immediate IT Operations

CVE-2026-93997

Detection coverage 2

Detects CVE-2026-93997 Exploitation - SQL Injection in edit_symptom.php

high

Detects exploitation attempts targeting the ID parameter of /Admin/edit_symptom.php using common SQL injection characters

sigma tactics: initial_access techniques: T1190 sources: webserver

Detects CVE-2026-94015 Exploitation - SQL Injection in Drug Recommendation System

high

Detects HTTP requests to the vulnerable edit_user.php script containing common SQL injection patterns in the ID parameter

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →