Overview
A SQL injection vulnerability has been disclosed in SourceCodester's Drug Recommendation System v1.0, a free PHP/MySQL healthcare-adjacent template used for symptom-to-medication lookups. Tracked as CVE-2026-93997, the flaw lets a remote, unauthenticated attacker inject arbitrary SQL through the ID parameter of /Admin/edit_symptom.php.
This is a different product from the Online Reviewer Management System injection cluster (CVE-2026-93959, -93973, -93974) reported the same week, but shares the same root cause: unsanitized ID parameters passed straight into SQL queries. SourceCodester's catalog of free PHP templates appears to share this coding pattern across multiple, otherwise-unrelated products.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-93997 |
| Severity | High (CVSS 3.1: 7.3) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| Weakness | CWE-74, CWE-89 (SQL Injection) |
| Vulnerable File | /Admin/edit_symptom.php |
| Parameter | ID |
| Authentication | None required |
| Exploit Maturity | Public PoC available |
How It Works
The ID argument passed to edit_symptom.php in the admin panel is concatenated directly into a backend SQL query without parameterization or input validation (CWE-89). No authentication gate protects the endpoint, so an attacker only needs network access to the vulnerable path to extract, modify, or destroy data in the underlying database — which, for this product, includes symptom-to-drug recommendation mappings.
Impact Assessment
Who Is At Risk
- Any organization or individual running Drug Recommendation System v1.0 with the
/Admin/path reachable over the network - Given the product's healthcare-adjacent framing, deployments could plausibly be running in clinics, pharmacies, or student healthcare-IT projects with real patient-facing data
Potential Impact
- Unauthorized read access to the full application database, including any patient/symptom records and admin credentials stored alongside them
- Data tampering — an attacker could alter symptom-to-medication mappings via injected
UPDATEstatements, a risk with direct real-world safety implications if the system genuinely influences care decisions - Data deletion or full database compromise via injected
DELETE/stacked queries where the driver permits them
Mitigation
- Rewrite the vulnerable query in
edit_symptom.phpto use parameterized queries or prepared statements. This is unmaintained template software — no official vendor patch channel exists - Deploy a WAF with SQL injection detection rules as an interim compensating control if immediate code changes aren't feasible
- Restrict network exposure of the
/Admin/path to trusted networks only - Audit for signs of prior exploitation — review database logs for anomalous queries against the
symptomtable - Given the healthcare-adjacent nature of the data this product handles, do not treat this as a low-priority template bug — evaluate whether continued use is appropriate for any deployment influencing real medical recommendations