CVE-2026-94035: Drug Recommendation System XSS Vulnerability

CVE-2026-94035 is a cross-site scripting vulnerability in SourceCodester Drug Recommendation System 1.0 affecting the index.php file. Attackers can exploit the full name parameter remotely to inject malicious scripts. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-94035 Overview

CVE-2026-94035 is a cross-site scripting (XSS) vulnerability [CWE-79] in SourceCodester Drug Recommendation System 1.0. The flaw resides in /drug_recommender/index.php, where the full name parameter is rendered without proper output encoding. An unauthenticated remote attacker can inject arbitrary JavaScript that executes in a victim's browser after user interaction. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed installations.

Critical Impact
Attackers can execute arbitrary script in the context of a victim's session, enabling credential theft, session hijacking, and defacement of the Drug Recommendation System interface.

Affected Products

SourceCodester Drug Recommendation System 1.0
Deployments exposing /drug_recommender/index.php
Web browsers rendering unsanitized output from the affected endpoint

Discovery Timeline

2026-09-20 - CVE-2026-94035 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-94035

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting issue in the Drug Recommendation System 1.0. Input supplied through the full name argument on /drug_recommender/index.php is echoed back to the response without HTML entity encoding or context-aware sanitization. When a user is tricked into loading a crafted URL or submitting a manipulated form, the attacker-controlled payload executes inside the victim's browser session.

Because exploitation occurs client-side, the attack does not compromise the server directly. However, it enables account takeover through cookie theft, phishing overlays inside the trusted application origin, and arbitrary Document Object Model (DOM) manipulation. The publicly disclosed proof-of-concept lowers the barrier for scripted abuse.

Root Cause

The root cause is missing input validation and output encoding on the full name parameter processed by /drug_recommender/index.php. The application concatenates user-controlled data into HTML output without applying a safe encoding routine, which violates standard XSS mitigation practices described in [CWE-79].

Attack Vector

Exploitation is remote and requires user interaction. An attacker crafts a URL or form submission containing a JavaScript payload in the full name field and delivers it via phishing, malicious link, or third-party site. When the victim triggers the request, the reflected payload executes in their browser under the application's origin. See the GitHub Project Readme and VulDB CVE-2026-94035 for technical details.

No verified code examples are available. Refer to the linked advisories for reproduction steps.

Detection Methods for CVE-2026-94035

Indicators of Compromise

Requests to /drug_recommender/index.php containing <script>, onerror=, onload=, or javascript: substrings within the full name parameter.
URL-encoded XSS payloads such as %3Cscript%3E or %3Cimg appearing in query strings or POST bodies targeting the endpoint.
Anomalous outbound requests from user browsers to attacker-controlled domains shortly after visiting the affected page.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect request parameters for common XSS payload signatures and block or alert on matches.
Enable server-side access logging for /drug_recommender/index.php and search for suspicious payload patterns in the full name field.
Correlate web server logs with browser telemetry to identify session anomalies following requests containing script fragments.

Monitoring Recommendations

Alert on repeated failed or malformed submissions to /drug_recommender/index.php from single source addresses.
Monitor referrer headers for links originating from untrusted domains that land on the vulnerable endpoint.
Track Content Security Policy (CSP) violation reports if a CSP is deployed, focusing on inline-script blocks tied to the affected page.

How to Mitigate CVE-2026-94035

Immediate Actions Required

Restrict public access to /drug_recommender/index.php until a patched build is deployed, using network controls or authentication gates.
Apply server-side input validation and HTML output encoding on the full name parameter and all other user-controlled fields.
Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources.

Patch Information

No official vendor patch is referenced in the enriched CVE data. Administrators should monitor SourceCodester Security Resources and the VulDB Vulnerability #407963 entry for updates and remediation guidance.

Workarounds

Configure a WAF rule to reject requests where the full name parameter contains HTML tags or JavaScript event handlers.
Set the HttpOnly and Secure flags on session cookies to reduce impact of successful script execution.
Educate users to avoid clicking untrusted links referencing the Drug Recommendation System and to report suspicious page behavior.

bash

# Example ModSecurity rule to block script payloads in the full name parameter
SecRule ARGS:"full name" "@rx (?i)(<script|onerror=|onload=|javascript:)" \
  "id:1094035,phase:2,deny,status:403,log,msg:'CVE-2026-94035 XSS attempt blocked'"