CVE-2026-108919: Drug Recommendation System XSS Vulnerability

CVE-2026-108919 Overview

CVE-2026-108919 is a cross-site scripting (XSS) vulnerability in SourceCodester Drug Recommendation System 1.0. The flaw resides in the student registration component, specifically in the Auth/add_student.php file. Attackers can manipulate the txtname, txtpassword, txtemail, txtphone, and txtprevious_school parameters to inject arbitrary script content. The attack can be launched remotely and requires user interaction to trigger payload execution. A public exploit has been disclosed, increasing the likelihood of opportunistic abuse against exposed deployments. This weakness is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation enables stored or reflected script execution in the browser of users interacting with the student registration workflow, enabling session abuse, phishing redirection, or UI manipulation.

Affected Products

SourceCodester Drug Recommendation System 1.0
Component: Student Registration (Auth/add_student.php)
Parameters: txtname, txtpassword, txtemail, txtphone, txtprevious_school

Discovery Timeline

2026-10-12 - CVE-2026-108919 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-108919

Vulnerability Analysis

The vulnerability is a reflected or stored cross-site scripting (XSS) issue in the registration workflow of SourceCodester Drug Recommendation System 1.0. The application accepts user-supplied values for several form fields without applying contextual output encoding or input sanitization. When these values are rendered back into HTML pages, injected script content executes in the context of the viewing user.

Because the registration endpoint is reachable without authentication, an attacker can craft a malicious request or lure a victim to a prepared page. The payload executes in the victim's browser session once the vulnerable content is rendered. Impact is limited to the integrity of the rendered page and any data accessible to the current user session.

Root Cause

The root cause is missing input validation and missing output encoding on parameters processed by Auth/add_student.php. The affected fields, txtname, txtpassword, txtemail, txtphone, and txtprevious_school, are passed into HTML output without neutralizing special characters such as <, >, ", and '. This maps directly to [CWE-79].

Attack Vector

The attack vector is network-based and requires user interaction. An attacker submits crafted input through the student registration form, or coerces a victim to submit the request. When an administrator or user later views the stored value, the injected JavaScript runs. The exploit is publicly available, which lowers the barrier to reproduce the issue.

No verified exploit code is included here. See the VulDB entry for CVE-2026-108919 for additional technical context.

Detection Methods for CVE-2026-108919

Indicators of Compromise

HTTP POST requests to Auth/add_student.php containing characters such as <script>, onerror=, onload=, or encoded equivalents in the vulnerable parameters.
Database rows in the student registration table containing HTML or JavaScript markup within name, email, phone, or school fields.
Unexpected outbound requests from browsers after rendering student records in administrative panels.

Detection Strategies

Inspect web server access logs for registration submissions containing suspicious tag characters or JavaScript keywords in form parameters.
Deploy a web application firewall (WAF) rule set that flags XSS payload patterns targeting the txt* parameters of the registration endpoint.
Perform content security scans against stored student records to identify previously injected markup.

Monitoring Recommendations

Enable verbose HTTP logging on the application and forward logs to a central analytics platform for pattern-based alerting.
Monitor browser-side Content Security Policy (CSP) violation reports when administrators load pages that render student data.
Alert on repeated submissions from the same source IP targeting the registration endpoint with abnormal payload sizes.

How to Mitigate CVE-2026-108919

Immediate Actions Required

Restrict public access to the Drug Recommendation System administrative interface until a fix is applied.
Deploy a WAF signature that blocks XSS metacharacters in the txtname, txtpassword, txtemail, txtphone, and txtprevious_school parameters.
Audit existing student records for injected markup and sanitize or remove affected entries.

Patch Information

No vendor patch is referenced in the enriched CVE data at the time of publication. Monitor the SourceCodester project page and the VulDB vulnerability record #416732 for remediation updates.

Workarounds

Implement server-side input validation that rejects HTML control characters in all registration fields.
Apply contextual output encoding (HTML entity encoding) when rendering any user-supplied value in templates.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Limit access to the registration page through network controls or authentication where operationally feasible.

bash

# Example nginx rule to block common XSS payload patterns on the vulnerable endpoint
location /Auth/add_student.php {
    if ($args ~* "(<script|onerror=|onload=|javascript:)") {
        return 403;
    }
    if ($request_body ~* "(<script|onerror=|onload=|javascript:)") {
        return 403;
    }
}