A critical SQL injection vulnerability in SourceCodester Drug Recommendation System 1.0 allows unauthenticated attackers to remotely extract sensitive database information and bypass authentication.

The application fails to sanitize the id parameter in the /drug_recommender/Admin/edit_user.php endpoint, which is directly concatenated into SQL queries. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend MySQL database.

Successful exploitation poses a severe risk to the confidentiality and integrity of the entire application database. Attackers can extract administrative credentials, dump sensitive patient or user data, and potentially gain full control over the application, leading to significant regulatory and reputational consequences. While the CVSS score is 7.3, the potential for full database extraction and authentication bypass warrants treating this as a high-priority incident.

Immediate Action: As no official patch is available, administrators should restrict network access to the /Admin directory via firewall or web server configuration to prevent unauthorized access.

Proactive Monitoring: Review web server access logs for suspicious GET requests to /drug_recommender/Admin/edit_user.php, specifically monitoring for patterns involving SQL syntax characters or time-based delay functions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads in URL parameters.

Public Exploit Available: Yes, a published proof-of-concept exists in the researcher's technical write-up on GitHub.

Given the critical nature of this SQL injection flaw and the availability of public exploitation details, immediate action is required to isolate the vulnerable endpoint. Organizations currently hosting this software should prioritize moving to a more secure alternative or implementing strict network-level access controls until the vendor provides a secure update.