Description

A flaw has been found in SourceCodester Online Voting System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_user. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-06T03:17:16.730Z",
  "pubdate": "2026-09-06T03:17:16.730Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in the SourceCodester Online Voting System 1.0, specifically within the /ajax.php endpoint.\nThis flaw allows remote, unauthenticated attackers to manipulate database queries by injecting malicious SQL commands via the 'ID' argument in the 'save_user' action.\nSuccessful exploitation grants an attacker the ability to bypass security controls, extract sensitive information, modify database records, or potentially gain administrative access to the underlying database management system.\nThe vulnerability poses a severe risk to data confidentiality, integrity, and availability, as it permits unauthorized interaction with the system's backend database.\nGiven that public exploit code is already available, the likelihood of automated or manual exploitation by malicious actors is high, necessitating immediate defensive measures.",
  "technicalDetails": "The vulnerability resides in the backend processing logic of the /ajax.php file within the Online Voting System 1.0 architecture. Specifically, the 'save_user' action fails to properly sanitize or parameterize the 'ID' parameter before incorporating it into a SQL query executed against the database.\nThe root cause is an improper neutralization of special elements used in an SQL command (CWE-89). By manipulating the 'ID' argument with crafted SQL syntax, an attacker can break out of the intended query structure, allowing for the injection of arbitrary SQL commands.\nThe attack flow begins with the attacker sending a specially crafted HTTP request to the /ajax.php endpoint. The 'action' parameter is set to 'save_user', and the 'ID' parameter is appended with malicious SQL payloads such as UNION-based statements or boolean-based blind injection characters.\nBecause the application logic does not employ prepared statements or utilize a robust database abstraction layer with automated parameter binding, the database engine interprets the attacker-supplied payload as legitimate code. This execution context grants the attacker the same permissions as the web application's database user account.\nExploitation is possible remotely without requiring authentication, expanding the attack surface to any network-reachable instance of the application. The payload behavior typically involves enumerating table names, dumping user credentials, or modifying application logic by updating administrative records.\nThe impact of this vulnerability is profound; successful exploitation can lead to a full compromise of the database contents. Attackers may perform unauthorized data exfiltration, deletion of voting records, or the creation of new administrative accounts to maintain persistent access. This flaw represents a critical failure in input validation, undermining the entire security posture of the Online Voting System."
}