Drug Recommendation System (1.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/drug-recommendation-system-1.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 20 Sep 2026 12:21:04 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSQL Injection in SourceCodester Drug Recommendation Systemhttps://feed.craftedsignal.io/briefs/2026-09-sourcecodester-sql-injection/Sun, 20 Sep 2026 12:21:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-sourcecodester-sql-injection/SourceCodester Drug Recommendation System 1.0 is vulnerable to remote SQL injection via the ID argument in /Admin/edit_symptom.php, allowing unauthenticated attackers to manipulate backend database queries.A SQL injection vulnerability has been identified in SourceCodester Drug Recommendation System version 1.0. The vulnerability resides within the /Admin/edit_symptom.php script, specifically affecting the handling of the 'ID' argument. This flaw allows remote, unauthenticated attackers to inject arbitrary SQL commands into the backend database. Publicly available exploit code exists, increasing the risk of unauthorized data access, modification, or complete database compromise. Organizations utilizing this software should restrict access to the administrative interface and review all application logs for anomalous SQL patterns originating from the /Admin/ directory.

Impact

Successful exploitation of this vulnerability permits remote attackers to execute arbitrary SQL queries against the application database. This can lead to the unauthorized disclosure of sensitive medical or system data, modification of existing records, or potentially administrative account takeover. Given the nature of the application as a drug recommendation system, the integrity of the data is critical.

Recommendation

  • Restrict access to the /Admin/ directory to known, authorized IP addresses via web server access control lists.
  • Deploy the provided Sigma rule to detect anomalous characters in the 'ID' parameter of the edit_symptom.php endpoint.
  • Audit database logs for unusual queries or UNION-based SQL injection patterns associated with the user account running the web application service.
  • Prioritize migration away from legacy, unsupported SourceCodester systems if patching is unavailable.
]]>highadvisoryweb-vulnerabilitysqli