CVE-2026-93997: SourceCodester Drug Recommendation System edit_symptom.php sql injection
A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected by this issue is some unknown functionality of the file /Admin/editsymptom.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable with no privileges or user interaction required. Exploitation involves manipulating the ID argument handled by /Admin/edit_symptom.php.
What is the potential impact of successful exploitation?
The provided CVSS vector indicates low impacts to confidentiality, integrity, and availability. The issue is classified as SQL injection, so successful exploitation may allow an attacker to affect backend database operations through the vulnerable parameter.
Is public exploit information available?
Yes. The exploit has been made public and could be used in attacks.
Which product version is identified as affected?
The affected product identified in the advisory is SourceCodester Drug Recommendation System version 1.0.