CVE-2026-105178: Drug Recommendation System SQL Injection

CVE-2026-105178 is a SQL injection vulnerability in SourceCodester Drug Recommendation System 1.0 affecting the symptom creation function. Attackers can manipulate the txtname parameter to execute malicious SQL queries remotely. This article covers technical details, exploitation methods, and security recommendations.

CVE-2026-105178 Overview

CVE-2026-105178 is a SQL injection vulnerability in SourceCodester Drug Recommendation System 1.0. The flaw resides in the mysqli_real_escape_string usage within /Admin/add_symptom.php, part of the Symptom Creation component. An authenticated attacker can manipulate the txtname parameter to inject arbitrary SQL statements. The attack is remotely exploitable over the network, and the exploit has been publicly disclosed. The vulnerability is categorized under CWE-74: Improper Neutralization of Special Elements in Output.

Critical Impact
Remote attackers with administrative privileges can inject SQL statements through the symptom creation form, potentially altering or exposing database records in the Drug Recommendation System.

Affected Products

SourceCodester Drug Recommendation System 1.0
Component: Symptom Creation (/Admin/add_symptom.php)
Affected function: mysqli_real_escape_string processing the txtname argument

Discovery Timeline

2026-10-05 - CVE-2026-105178 published to the National Vulnerability Database
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105178

Vulnerability Analysis

The vulnerability exists in the administrative symptom creation workflow of the Drug Recommendation System. The add_symptom.php script accepts a txtname parameter submitted via HTTP request. Although mysqli_real_escape_string is invoked, the surrounding query construction does not safely parameterize the input. An attacker who can authenticate to the admin interface can craft a txtname payload containing SQL metacharacters that break out of the intended query context. Successful exploitation allows unauthorized reads, writes, or deletions against the backend database. Because the exploit code is publicly available, defenders should assume opportunistic attempts against exposed instances.

Root Cause

The root cause is improper neutralization of user-supplied input in a database query [CWE-74]. The application relies on mysqli_real_escape_string rather than prepared statements with bound parameters. Escaping alone is insufficient when input is concatenated into contexts outside quoted string literals, enabling SQL injection despite the escape call.

Attack Vector

The attack vector is network-based and requires administrative authentication to the application. An attacker submits a crafted POST request to /Admin/add_symptom.php with a malicious txtname value. The server-side query executes the injected SQL fragment against the underlying MySQL database. No user interaction is required beyond the attacker's own request. See the VulDB entry for CVE-2026-105178 for additional technical context.

No verified exploit code is reproduced here. Technical submissions and proof-of-concept details are documented in VulDB Submission #970934.

Detection Methods for CVE-2026-105178

Indicators of Compromise

POST requests to /Admin/add_symptom.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or ; in the txtname parameter.
Unexpected database errors or anomalous row counts in the symptom table following administrative sessions.
Administrative login activity from unusual IP addresses preceding malformed add_symptom.php requests.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST bodies submitted to admin endpoints for SQL injection payloads.
Enable MySQL general query logging on development or staging instances to validate parameterization and surface injected statements.
Correlate authenticated admin session identifiers with query patterns that deviate from legitimate symptom-creation workflows.

Monitoring Recommendations

Monitor web server access logs for repeated 500 responses or unusually long txtname values submitted to the Symptom Creation endpoint.
Alert on administrative account creation or privilege changes that follow suspicious requests to /Admin/add_symptom.php.
Review database audit logs for INSERT, UPDATE, or DROP statements executed outside expected admin working hours.

How to Mitigate CVE-2026-105178

Immediate Actions Required

Restrict network access to the /Admin/ directory to trusted administrator IP ranges using firewall or reverse-proxy ACLs.
Rotate administrative credentials and enforce strong, unique passwords for all admin accounts of the Drug Recommendation System.
Deploy WAF signatures targeting SQL injection payloads directed at add_symptom.php until a code-level fix is applied.

Patch Information

No vendor patch is currently referenced in the NVD advisory. SourceCodester project pages are available at SourceCodester. Operators should track that resource and the VulDB vulnerability record #413410 for remediation updates.

Workarounds

Replace mysqli_real_escape_string concatenation in add_symptom.php with prepared statements using mysqli::prepare and bound parameters.
Apply strict server-side input validation to the txtname field, allowlisting alphanumeric characters and spaces only.
Remove or disable the Symptom Creation feature in production environments until a verified fix is in place.

bash

# Example nginx configuration restricting admin access by source IP
location ^~ /Admin/ {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://127.0.0.1:8080;
}