SQL Injection Vulnerability in Drug Recommendation System

SourceCodester Drug Recommendation System version 1.0 contains a critical SQL injection vulnerability identified as CVE-2026-105175. The flaw resides within the /Auth/add_student.php script, specifically in the processing of the 'cmdschool' parameter within the Student Registration component. Because this parameter is inadequately sanitized before being processed by the backend database, an unauthenticated remote attacker can inject arbitrary SQL commands. Publicly available exploit material exists for this vulnerability, posing a significant risk to organizations using this software. Successful exploitation allows an attacker to manipulate database queries, potentially leading to unauthorized data access, modification, or deletion, depending on the privileges of the database service account.

Impact

The vulnerability allows unauthenticated remote attackers to compromise the backend database associated with the Drug Recommendation System. This could lead to full data exfiltration of sensitive student or system records, integrity loss through unauthorized modifications, or complete database control, which may facilitate further system compromise.

Recommendation

• Block requests targeting /Auth/add_student.php where the 'cmdschool' parameter contains common SQL injection sequences (e.g., apostrophes, comment characters).
• Deploy the provided Sigma rule to webserver logs to monitor for exploitation attempts targeting CVE-2026-105175.
• Audit database permissions for the web application service account to ensure the principle of least privilege is applied, limiting the impact of a successful SQL injection.