CVE-2026-108919 in Drug Recommendation System
Summary
by MITRE • 10/12/2026
A weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted element is an unknown function of the file Auth/add_student.php of the component Student Registration. This manipulation of the argument txtname/txtpassword/txtemail/txtphone/txtprevious_school causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The SourceCodester Drug Recommendation System version 1.0 contains a critical security flaw within its student registration module, specifically located in the Auth/add_student.php file. This vulnerability manifests as a stored cross-site scripting (XSS) issue arising from insufficient input validation and sanitization of user-supplied data. The affected parameters include txtname, txtpassword, txtemail, txtphone, and txtprevious_school. When an attacker submits malicious script payloads through these fields during the student registration process, the application fails to properly encode or filter the injected code before storing it in the backend database or reflecting it back in subsequent responses. This lack of proper output encoding allows arbitrary JavaScript code to be executed within the context of a victim user's browser when they view the stored data, such as viewing registered students' profiles or administrative dashboards that display this information.
From an operational perspective, this vulnerability poses significant risks to both end-users and system administrators. Because the XSS payload is likely stored in the database, it persists across sessions and affects every user who accesses the compromised page, rather than just the initial attacker. This persistence amplifies the impact significantly compared to reflected XSS attacks. Attackers can exploit this weakness to steal session cookies or authentication tokens, leading to account takeover and unauthorized access to sensitive student records or system configurations. Furthermore, the malicious scripts can perform actions on behalf of the victim, such as changing passwords, modifying personal information, or initiating transactions if applicable within the broader application context. The availability of public exploits lowers the barrier to entry for attackers, increasing the likelihood of automated scanning and exploitation attempts against instances of this software running in production environments.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. It also maps to MITRE ATT&CK technique T1059, specifically sub-technique 007 for JavaScript execution, and potentially T1204 if used for initial user interaction leading to further compromise. The remote nature of the attack means that no local access or prior authentication is required to trigger the injection phase, although exploitation may require a victim with valid credentials to view the stored payload depending on how the application renders the data.
To mitigate this vulnerability, immediate remediation efforts should focus on implementing robust input validation and output encoding mechanisms within the Auth/add_student.php script. Developers must ensure that all user-supplied inputs are strictly validated against expected formats using allowlists for characters and lengths where applicable. More critically, any data retrieved from the database and rendered in HTML responses must be properly encoded to prevent browser interpretation of special characters as executable code. Utilizing context-aware output encoding libraries specific to the rendering context is essential. Additionally, implementing Content Security Policy headers can provide an additional layer of defense by restricting the sources from which scripts are allowed to execute. Regular security audits and penetration testing should be conducted to identify similar flaws in other parts of the application that may suffer from inadequate input handling practices.