Administrator session hijacking via unencoded form values

Reflected XSS in SourceCodester Drug Recommendation System 1.0 allows remote authenticated users to run script in an administrator's browser. The /drug_recommender/Admin/add_user handler places POST values from txtname, txtemail, and txtpassword into HTML value attributes without output encoding, permitting attribute breakout; the same payload is stored for later rendering. Exploitation requires access to the administrator workflow and administrator interaction; injected JavaScript can read the non-HttpOnly PHPSESSID and perform actions in that session.