CVE-2026-105176: Drug Recommendation System SQLi Vulnerability

CVE-2026-105176 Overview

CVE-2026-105176 is a SQL injection vulnerability in SourceCodester Drug Recommendation System 1.0. The flaw resides in the /Admin/edit_class.php file, where the ID parameter is passed to a database query without proper sanitization. Attackers who possess authenticated administrative access can manipulate the ID argument to inject arbitrary SQL statements. The vulnerability is exploitable remotely over the network, and a public exploit has been disclosed. The weakness is classified under CWE-74: Improper Neutralization of Special Elements in Output.

Critical Impact

Authenticated remote attackers can inject SQL into the ID parameter of /Admin/edit_class.php, potentially exposing or modifying backend database contents in the Drug Recommendation System.

Affected Products

• SourceCodester Drug Recommendation System 1.0
• Component: /Admin/edit_class.php
• Vulnerable parameter: ID

Discovery Timeline

• 2026-10-05 - CVE-2026-105176 published to the National Vulnerability Database
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105176

Vulnerability Analysis

The vulnerability affects the administrative class-editing functionality of the Drug Recommendation System. The edit_class.php script accepts an ID parameter from client-supplied input and incorporates it into a SQL query without parameterization or escaping. An attacker with administrator privileges can submit crafted input that alters the query logic.

Successful exploitation allows the attacker to read, modify, or delete records stored in the backend database. Because the application processes drug and class records, injected queries can disclose sensitive clinical data or corrupt application state. The attack requires administrator-level authentication, which limits exposure to insiders or attackers who have previously compromised an admin account.

Root Cause

The root cause is improper neutralization of special elements passed through the ID parameter [CWE-74]. The affected code concatenates user-controlled input directly into a SQL statement rather than using prepared statements or input validation. Any SQL metacharacter supplied in ID becomes part of the executed query.

Attack Vector

Exploitation occurs over the network through a standard HTTP request to the administrative endpoint. The attacker authenticates to the admin panel, then issues a request such as a GET or POST to /Admin/edit_class.php with a malicious ID value. Payloads typically include SQL operators such as UNION SELECT, boolean conditions, or time-based blind injection probes to extract data.

The vulnerability is described in the VulDB CVE-2026-105176 entry and the associated VulDB Vulnerability #413408 record. No verified proof-of-concept code is included in this article; refer to the external references for technical specifics.

Detection Methods for CVE-2026-105176

Indicators of Compromise

• HTTP requests to /Admin/edit_class.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP, or -- within the ID parameter.
• Database error messages logged by the application referencing MySQL syntax errors tied to the edit_class operation.
• Unexpected administrative session activity originating from unfamiliar IP addresses or at unusual hours.
• Database queries returning unusually large result sets or targeting tables outside the normal workflow of class editing.

Detection Strategies

• Deploy a web application firewall (WAF) with SQL injection signatures tuned for the ID parameter on administrative paths.
• Enable verbose database query logging to capture statements referencing the class table and review for anomalous UNION or subquery patterns.
• Correlate authentication logs for the admin role with subsequent requests to edit_class.php to detect suspicious sequences.

Monitoring Recommendations

• Monitor HTTP access logs for repeated requests to /Admin/edit_class.php with varying ID values indicative of enumeration.
• Alert on database errors emitted by PHP, which often indicate injection probing.
• Track outbound data volumes from the database host to identify bulk extraction attempts.

How to Mitigate CVE-2026-105176

Immediate Actions Required

• Restrict access to the /Admin/ directory using IP allowlists or VPN-only access until a fix is applied.
• Rotate credentials for all administrative accounts to limit the impact of a previously compromised admin password.
• Review database audit logs for signs of prior exploitation against the edit_class.php endpoint.
• Enforce the principle of least privilege on the database account used by the web application.

Patch Information

No vendor patch has been published for SourceCodester Drug Recommendation System 1.0 at the time of CVE assignment. Operators should monitor the SourceCodester Security Resources page for updates. Until an official fix is available, apply source-level remediation by replacing concatenated SQL in edit_class.php with parameterized queries using PDO or mysqli prepared statements.

Workarounds

• Implement server-side input validation that restricts ID to numeric values before any database operation.
• Deploy a WAF rule that blocks SQL metacharacters in the ID parameter of /Admin/edit_class.php.
• Disable or remove the class-editing feature if it is not operationally required.
• Isolate the application behind an authenticated reverse proxy that enforces additional access controls.

# Example WAF rule (ModSecurity) to block SQL metacharacters in the ID parameter
SecRule REQUEST_URI "@beginsWith /Admin/edit_class.php" \
    "id:1051760,phase:2,deny,status:403,\
    chain,msg:'Potential SQLi against edit_class.php ID parameter'"
    SecRule ARGS:ID "@rx [^0-9]" "t:none"