CVE-2026-105175: Drug Recommendation System SQL Injection

CVE-2026-105175 is a SQL injection vulnerability in SourceCodester Drug Recommendation System 1.0 affecting student registration functionality. Attackers can exploit the cmdschool parameter remotely to manipulate database queries. This article covers technical details, impact assessment, and mitigation strategies.

CVE-2026-105175 Overview

CVE-2026-105175 is a SQL injection vulnerability in SourceCodester Drug Recommendation System 1.0. The flaw resides in the /Auth/add_student.php script within the Student Registration component. Attackers can manipulate the cmdschool parameter to inject arbitrary SQL statements into backend queries. The issue is remotely exploitable without authentication or user interaction, and a public exploit has been disclosed. The weakness maps to CWE-74: Improper Neutralization of Special Elements in Output.

Critical Impact
Unauthenticated remote attackers can inject SQL through the cmdschool parameter to read, modify, or delete database records in the Drug Recommendation System.

Affected Products

SourceCodester Drug Recommendation System 1.0
Component: Student Registration (/Auth/add_student.php)
Vulnerable parameter: cmdschool

Discovery Timeline

2026-10-05 - CVE-2026-105175 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105175

Vulnerability Analysis

The vulnerability is an unauthenticated SQL injection in the student registration endpoint of the Drug Recommendation System. The add_student.php handler passes the cmdschool request parameter into a SQL statement without proper sanitization or parameterization. Attackers can submit crafted input that terminates the intended query and appends additional SQL clauses.

Because the endpoint belongs to the authentication flow but does not require prior credentials, exploitation requires only network access to the web application. Successful injection exposes any data accessible to the database user backing the application, including student records, credentials, and recommendation data.

The public disclosure of exploit details lowers the skill barrier. Automated scanners and opportunistic actors can weaponize the parameter with standard SQL injection payloads such as boolean-based, union-based, or time-based techniques.

Root Cause

The root cause is improper neutralization of special characters in user-supplied input before it reaches the SQL interpreter [CWE-74]. The cmdschool argument is concatenated into a query string instead of being bound through prepared statements. No server-side validation enforces an expected format for the parameter.

Attack Vector

An attacker sends an HTTP request to /Auth/add_student.php with a malicious cmdschool value. The injected payload alters the SQL query executed by the backend, allowing extraction or modification of database contents. No authentication, privileges, or user interaction are required. See the VulDB entry for CVE-2026-105175 and the vulnerability record #413407 for additional technical context.

Detection Methods for CVE-2026-105175

Indicators of Compromise

Inbound HTTP POST or GET requests to /Auth/add_student.php containing SQL metacharacters such as single quotes, UNION SELECT, SLEEP(, --, /*, or OR 1=1 in the cmdschool parameter.
Database error messages or stack traces referencing cmdschool in web server logs.
Unusual spikes in response time for add_student.php requests, indicative of time-based blind SQL injection.
Unexpected read access to sensitive tables or new rows in the student registration table originating from the web application's database user.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the cmdschool parameter for SQL injection signatures.
Enable database query logging and alert on queries containing concatenated input to the student registration table.
Correlate web server access logs with database audit logs to identify abnormal query patterns tied to /Auth/add_student.php.

Monitoring Recommendations

Monitor HTTP 500 responses and database driver exceptions from the application host.
Track outbound data volume from the database server to detect bulk extraction attempts.
Alert on repeated requests to add_student.php from a single source IP within a short window.

How to Mitigate CVE-2026-105175

Immediate Actions Required

Restrict network access to the Drug Recommendation System to trusted networks or disable the application until a fix is applied.
Deploy WAF signatures to block SQL injection payloads targeting /Auth/add_student.php and the cmdschool parameter.
Rotate database credentials used by the application and audit the database for unauthorized modifications.
Review web server and database logs for prior exploitation attempts referencing cmdschool.

Patch Information

No vendor patch has been published at the time of this writing. SourceCodester has not released a fixed version addressing CVE-2026-105175. Monitor the SourceCodester project site for updates and apply any issued patches immediately. If running this application in production, consider replacing it or forking the source to apply parameterized queries directly.

Workarounds

Modify /Auth/add_student.php to use prepared statements with bound parameters (for example, mysqli_prepare or PDO with bindParam) instead of string concatenation.
Apply strict server-side input validation on cmdschool, allowing only expected characters such as alphanumerics.
Enforce least privilege on the database account used by the application, removing DROP, ALTER, and FILE permissions.
Place the application behind an authenticated reverse proxy to limit anonymous access to the registration endpoint.

bash

# Example ModSecurity rule to block SQL injection against cmdschool
SecRule ARGS:cmdschool "@detectSQLi" \
    "id:1050175,\
    phase:2,\
    deny,\
    status:403,\
    msg:'CVE-2026-105175 SQLi attempt on cmdschool parameter',\
    tag:'application-multi',\
    tag:'attack-sqli'"