CVE-2026-94016: Drug Recommendation System XSS Vulnerability

CVE-2026-94016 Overview

CVE-2026-94016 is a cross-site scripting (XSS) vulnerability [CWE-79] in SourceCodester Drug Recommendation System 1.0. The flaw resides in the /drug_recommender/Admin/add_symptom endpoint, where the txtname parameter is not properly sanitized before being reflected in application output. An authenticated attacker can inject arbitrary JavaScript that executes in the browser context of any user viewing the affected page.

The exploit has been publicly released, increasing the likelihood of opportunistic use against exposed installations. Successful exploitation requires high privileges and user interaction, which limits impact but still enables session-context script execution against administrative interfaces.

Critical Impact
Public exploit code targets an administrative endpoint, allowing script injection into the admin panel of the Drug Recommendation System.

Affected Products

SourceCodester Drug Recommendation System 1.0
Component: /drug_recommender/Admin/add_symptom
Vulnerable parameter: txtname

Discovery Timeline

2026-09-20 - CVE-2026-94016 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94016

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting issue in the administrative symptom-management workflow of the Drug Recommendation System. When an administrator submits data through the add_symptom handler, the application accepts the txtname argument and renders it back into HTML output without applying context-appropriate encoding.

Because the vulnerable endpoint lives under the /Admin/ path, exploitation targets privileged sessions. An attacker who already possesses valid administrative credentials, or who can trick an administrator into submitting a crafted request, can plant JavaScript that executes with the victim's session privileges.

The attack is network-reachable and requires user interaction to trigger the injected payload. Impact is limited to integrity of the rendered page and any actions available to the affected administrator's browser session.

Root Cause

The root cause is missing output encoding and input sanitization on the txtname field of the add_symptom handler. The application concatenates untrusted user input into HTML without applying HTML entity encoding or a content-security-policy allowlist, permitting arbitrary <script> and event-handler payloads to render.

Attack Vector

Exploitation requires network access to the application and an authenticated administrative account. The attacker submits a crafted txtname value containing JavaScript through the add_symptom form. When the injected content is subsequently rendered by an administrator, the payload executes in that user's browser context.

Technical details are documented in the GitHub XSS Project Readme and the VulDB CVE-2026-94016 entry.

Detection Methods for CVE-2026-94016

Indicators of Compromise

HTTP POST requests to /drug_recommender/Admin/add_symptom containing <script>, onerror=, onload=, or javascript: tokens in the txtname parameter.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting the symptoms listing page.
Persisted symptom entries whose displayed name contains HTML tags, encoded angle brackets, or JavaScript event handlers.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the txtname field for HTML tags and JavaScript event handlers.
Review web server access logs for anomalous payloads targeting the /Admin/add_symptom route, especially from unauthenticated or unusual source addresses.
Correlate administrator authentication events with subsequent symptom-creation activity to identify suspicious form submissions.

Monitoring Recommendations

Enable verbose HTTP request logging on the administrative interface and forward logs to a centralized analytics platform.
Monitor Content Security Policy (CSP) violation reports if a report-only policy is deployed in front of the application.
Alert on repeated 200-response POSTs to add_symptom from a single source within a short time window.

How to Mitigate CVE-2026-94016

Immediate Actions Required

Restrict network access to the /drug_recommender/Admin/ path to trusted management networks or VPN users only.
Rotate administrator credentials and audit recent symptom entries for HTML or JavaScript content.
Deploy a WAF rule that blocks or sanitizes HTML metacharacters in the txtname parameter.

Patch Information

No vendor patch has been published in the referenced advisories at the time of writing. Refer to the SourceCodester Code Repository and the VulDB Vulnerability #407956 entry for updates. Operators should apply source-level fixes by adding HTML entity encoding to all output of the txtname field and validating input against an allowlist of expected characters.

Workarounds

Add server-side input validation that rejects <, >, and quote characters in the txtname field before persistence.
Apply HTML entity encoding (for example, htmlspecialchars($value, ENT_QUOTES, 'UTF-8') in PHP) at every point where symptom names are rendered.
Deploy a strict Content Security Policy header such as Content-Security-Policy: default-src 'self'; script-src 'self' to constrain inline script execution.

bash

# Example Apache configuration to add a restrictive CSP header
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"
Header always set X-XSS-Protection "1; mode=block"
Header always set X-Content-Type-Options "nosniff"