CVE-2026-105177: Drug Recommendation System SQL Injection

CVE-2026-105177 Overview

CVE-2026-105177 is a SQL injection vulnerability in SourceCodester Drug Recommendation System 1.0. The flaw resides in the /Admin/add_drug.php endpoint within the Drug Creation component. Attackers can manipulate the txtname, cmdtype, txtusage, txtsideeffect, and cmdcontraindication parameters to inject arbitrary SQL statements. The attack is remotely exploitable and requires high privileges on the target application. Public exploit details have been disclosed through VulDB, increasing the likelihood of opportunistic exploitation against exposed deployments. The vulnerability is tracked under CWE-74 for improper neutralization of special elements in output used by a downstream component.

Critical Impact
Authenticated administrators can execute arbitrary SQL queries against the backend database, exposing drug records and potentially compromising data integrity.

Affected Products

SourceCodester Drug Recommendation System 1.0
Component: Drug Creation (/Admin/add_drug.php)
Deployments using the unmodified upstream codebase from SourceCodester

Discovery Timeline

2026-10-05 - CVE-2026-105177 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105177

Vulnerability Analysis

The SourceCodester Drug Recommendation System accepts administrator-supplied drug metadata through the add_drug.php form handler. The handler concatenates user input directly into SQL statements executed against the backend database. Because the affected parameters are not parameterized or sanitized, an attacker who holds administrator credentials can break out of the intended string context and append arbitrary SQL. Successful injection may allow data exfiltration, modification of drug records, authentication state tampering, or pivoting to other application tables. The exploit is public, which lowers the barrier for less-skilled attackers to weaponize the flaw against exposed instances.

Root Cause

The root cause is improper neutralization of special elements in a downstream SQL command [CWE-74]. The affected code path trusts the txtname, cmdtype, txtusage, txtsideeffect, and cmdcontraindication POST parameters and inserts their values into INSERT or UPDATE statements without prepared statements or input validation.

Attack Vector

An authenticated administrator submits a crafted request to /Admin/add_drug.php containing SQL metacharacters in one or more of the vulnerable fields. The database engine executes the injected payload within the context of the application's database user. Exploitation requires network reachability to the admin interface and valid high-privilege credentials. Refer to the VulDB entry for CVE-2026-105177 for additional technical context.

// No verified exploit code is published. See the VulDB advisory for
// technical submission details: https://vuldb.com/vuln/413409

Detection Methods for CVE-2026-105177

Indicators of Compromise

POST requests to /Admin/add_drug.php containing SQL metacharacters such as single quotes, UNION SELECT, --, or ; in the txtname, cmdtype, txtusage, txtsideeffect, or cmdcontraindication parameters.
Unexpected rows, modified records, or new administrator accounts in the application database.
Web server error logs showing SQL syntax errors originating from the drug creation endpoint.

Detection Strategies

Deploy a web application firewall (WAF) ruleset tuned for SQL injection patterns on requests targeting add_drug.php.
Enable database query logging and alert on administrative queries that contain tautologies, stacked statements, or UNION clauses.
Correlate authentication events with high-volume submissions to the drug creation endpoint to identify abuse of valid admin sessions.

Monitoring Recommendations

Monitor administrator login activity for sessions originating from unexpected IP ranges or geographies.
Track changes to the drug catalog tables and alert on bulk inserts or schema reads from the application account.
Review access logs for repeated 500-series responses tied to the /Admin/ path, which often indicate injection probing.

How to Mitigate CVE-2026-105177

Immediate Actions Required

Restrict access to the /Admin/ directory using IP allow-lists or VPN-only access until a patched build is deployed.
Rotate administrator credentials and enforce strong, unique passwords for all admin accounts.
Audit the drug catalog tables for unauthorized modifications introduced after the exposure window.

Patch Information

At the time of publication, no official vendor patch is listed in the NVD entry. Monitor the SourceCodester project page and the VulDB vulnerability record for remediation updates. Operators maintaining their own forks should refactor add_drug.php to use parameterized queries (PDO prepared statements or mysqli_prepare) for every affected parameter.

Workarounds

Place the application behind a WAF that blocks SQL injection payloads on POST requests to admin endpoints.
Apply server-side input validation that rejects SQL metacharacters in the five affected form fields before they reach the database layer.
Operate the database connection under a least-privilege account that cannot alter schema or read sensitive tables outside the drug catalog.

bash

# Example Apache configuration to restrict admin access by source IP
<Location "/Admin/">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>