Description

A vulnerability has been found in SourceCodester Online Voting System 1.0. The affected element is an unknown function of the file /ajax.php?action=delete_voting. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-06T03:17:16.913Z",
  "pubdate": "2026-09-06T03:17:16.913Z",
  "executiveSummary": "The SourceCodester Online Voting System 1.0 contains a critical SQL injection vulnerability within the /ajax.php endpoint. This flaw allows unauthenticated or remote attackers to manipulate the ID argument, facilitating unauthorized interaction with the backend database.\nThe vulnerability type is identified as SQL Injection (SQLi), which poses a significant risk to data confidentiality, integrity, and availability. By injecting malicious SQL queries through the vulnerable parameter, an attacker can bypass standard application logic, exfiltrate sensitive database contents, modify application data, or potentially achieve full administrative control over the database management system.\nThis vulnerability is remotely exploitable and does not require complex prerequisites, making it highly attractive for automated exploitation. The exposure is heightened by the public availability of exploit code, increasing the likelihood of successful targeting. Organizations utilizing this version of the Online Voting System are at high risk of data breaches and service disruption. Immediate remediation is required to sanitize all user-supplied inputs before they are utilized in database queries.",
  "technicalDetails": "The vulnerability resides in the /ajax.php file, specifically within the logic handling the 'delete_voting' action. The application fails to adequately sanitize or parameterize the 'ID' argument before incorporating it into a database query string.\nThe root cause is the improper neutralization of special elements used in an SQL command. The vulnerability allows an attacker to break out of the intended SQL statement structure by injecting crafted SQL syntax into the ID parameter. Because the application processes these requests directly, the database engine executes the attacker-supplied commands with the privileges assigned to the database user configured for the web application.\nThe attack flow proceeds as follows: An attacker sends a crafted HTTP request targeting /ajax.php?action=delete_voting. By appending malicious SQL payloads to the ID parameter (e.g., using UNION-based injection or boolean-based blind techniques), the attacker alters the query logic. For instance, an attacker could append 'OR 1=1' to force the deletion of unauthorized records or utilize 'UNION SELECT' statements to leak database schemas, user credentials, or system configuration details.\nThis vulnerability is particularly dangerous because it occurs in an AJAX-driven component, often bypassed by basic security filters that monitor standard page loads. The attack does not necessarily require the victim to be authenticated, depending on the specific implementation of the session management in the voting system. Post-exploitation impact ranges from unauthorized data deletion and integrity loss to complete exfiltration of the entire database content. Given the public nature of the exploit, the barrier to entry is extremely low, allowing attackers to leverage existing scripts to automate the discovery and compromise of vulnerable installations. The lack of input validation and the use of dynamic string concatenation in the backend code constitute a fundamental security failure in the application's design."
}