CVE-2026-105177: SourceCodester Drug Recommendation System Drug Creation add_drug.php sql injection
A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. The affected element is an unknown function of the file /Admin/adddrug.php of the component Drug Creation. Such manipulation of the argument txtname/cmdtype/txtusage/txtsideeffect/cmdcontraindication leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability has a high privileges required rating (PR:H), so the attacker needs high-level privileges before exploiting the affected Drug Creation functionality. Exploitation can be performed remotely and does not require user interaction.
Which inputs are implicated in the SQL injection?
The affected /Admin/add_drug.php endpoint is vulnerable through manipulation of the txtname, cmdtype, txtusage, txtsideeffect, or cmdcontraindication arguments.
Is exploit code available?
Yes. The exploit is publicly available, which increases the likelihood that attackers with the required privileges could use it.