CVE-2026-105178: SourceCodester Drug Recommendation System Symptom Creation add_symptom.php mysqli_real_escape_string sql injection
A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. The impacted element is the function mysqlirealescapestring of the file /Admin/addsymptom.php of the component Symptom Creation. Performing a manipulation of the argument txtname results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerable endpoint can be attacked remotely, but the supplied severity vector indicates high privileges are required. No user interaction is required.
Which input and endpoint should defenders prioritize for investigation?
The issue is in the Symptom Creation component at /Admin/add_symptom.php. The affected input is the txtname argument, which can be manipulated to trigger SQL injection.
Is public exploit code available?
Yes. The exploit has been publicly released, so organizations should assume exploitation attempts may occur.