| Title | SourceCodester Drug Recommendation System Using Machine Learning, PHP, and MySQL Database 1.0 Cross Site Scripting |
|---|
| Description | A Cross-Site Scripting (XSS) vulnerability (CWE-79) was found in SourceCodester Drug Recommendation System Using Machine Learning, PHP, and MySQL Database v1.0. The issue affects the /drug_recommender/Admin/add_symptom endpoint through the txtname POST parameter. User input is reflected back into the HTML response without proper output encoding, allowing an authenticated attacker to inject and execute JavaScript in the administrator's browser. Testing also showed that the PHPSESSID session cookie could be accessed through JavaScript because the cookie does not have the HttpOnly flag, which could potentially lead to session hijacking and unauthorized access to administrator functionality and sensitive application data.
Product Website:
https://www.sourcecodester.com/php/18278/drug-recommender-web-app-student-project.html
RESEARCHERS:
Researcher 1: Karan Parelkar
Email: [email protected]
GitHub: https://github.com/KaranParelkar
LinkedIn: https://www.linkedin.com/in/karan-parelkar-6a370125b/
Researcher 2: Anubhav Verma
Email: [email protected]
GitHub: https://github.com/anubhavv106
LinkedIn: https://www.linkedin.com/in/anubhav-verma-7123a1232/
Researcher 3: Parth Desai
Email: [email protected]
GitHub: https://github.com/ParthD31
LinkedIn: https://www.linkedin.com/in/parth-desai-801951224/ |
|---|
| Source | ⚠️ https://github.com/KaranParelkar/Drug_recommendation_system/blob/main/xss/add_symptom/Readme.md |
|---|
| User | anubhav106 (UID 98769) |
|---|
| Submission | 08/24/2026 15:53 (26 days ago) |
|---|
| Moderation | 09/19/2026 17:22 (26 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 407956 [SourceCodester Drug Recommendation System 1.0 add_symptom txtname cross site scripting] |
|---|
| Points | 20 |
|---|