Executive brief
SourceCodester Drug Recommendation System is a PHP/MySQL web application for recommending medications. Database credentials are stored in plaintext within the publicly distributed SQL dump file, allowing attackers to gain unauthorized access to the application and sensitive patient/user data without any authentication.
Technical details
The vulnerability is a sensitive information disclosure (CWE-200) where plaintext database credentials are embedded in the publicly distributed /db/drug_recommendor.sql file. The vulnerable component is the database initialization script itself, which contains hardcoded credentials accessible via direct file download without authentication. An attacker can obtain these credentials by downloading the source code from SourceCodester and opening the SQL dump file in any text editor. Once credentials are obtained, an attacker can connect to the MySQL database and extract or modify sensitive information. The remediation requires removing credentials from the distribution, using encrypted/hashed credentials, and rotating any exposed credentials.
Affected products
- SourceCodester Drug Recommendation System 1.0
Timeline
- 2026-09-17: disclosed: CVE-2026-92927 published; exploit code made public on GitHub