A SQL injection flaw exists in the /drug_recommender/Admin/edit_user.php file of SourceCodester Drug Recommendation System 1.0. By manipulating the ID argument, an attacker can construct arbitrary SQL statements that are executed by the backend database, potentially exposing, modifying, or deleting sensitive data. The weakness falls under CWE-89 (SQL Injection) and CWE-74 (Input containing or related to file paths). The result is a remote data tampering or disclosure vulnerability that can undermine both confidentiality and integrity of the system.

The vulnerability affects the SourceCodester Drug Recommendation System version 1.0. Any deployment that includes the edit_user.php component and does not have the patch applied is susceptible. The specific function that accepts the ID parameter is not enumerated beyond the edit_user.php file, so all instances using this code path are at risk.

The CVSS score of 6.9 indicates moderate severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. The description confirms that the exploit may be launched remotely via HTTP and that the exploit code is publicly available. Attackers only need to supply a crafted ID value in a request, no additional credentials or privileged access are required, making the vulnerability relatively easy to exploit across affected installations.