Description

A vulnerability was found in SourceCodester Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=delete_category. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-06T03:17:17.067Z",
  "pubdate": "2026-09-06T03:17:17.067Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in the SourceCodester Online Voting System 1.0, specifically within the /ajax.php endpoint.\nThe vulnerability arises from insufficient sanitization of user-supplied input provided to the 'ID' parameter during the deletion of categories.\nSuccessful exploitation allows a remote, unauthenticated or authenticated attacker to inject arbitrary SQL commands into the backend database, potentially leading to unauthorized data exposure, modification, or complete database compromise.\nThe vulnerability is currently public, increasing the risk of exploitation by malicious actors.\nThe impact includes full administrative control over the database management system, potentially compromising the integrity and confidentiality of the entire voting system platform.",
  "technicalDetails": "The vulnerability is categorized as a classic SQL injection residing within the /ajax.php file of the SourceCodester Online Voting System 1.0. The flaw manifests in the 'delete_category' action handling logic, where the 'ID' parameter is passed directly into a database query without adequate input validation or the use of prepared statements.\nRoot Cause: The application utilizes unsanitized user input from the HTTP request to construct dynamic SQL queries. By manipulating the 'ID' argument, an attacker can break out of the intended query structure, allowing for the injection of arbitrary SQL syntax. This indicates a failure to implement parameterized queries or robust server-side input filtering.\nAttack Flow: An attacker initiates an HTTP request to /ajax.php?action=delete_category, supplying a malicious payload within the 'ID' parameter. The server-side script retrieves this value and concatenates it directly into a DELETE query. By injecting crafted SQL commands—such as UNION-based statements or blind SQLi payloads—the attacker can manipulate the query logic to extract sensitive information from the underlying database tables.\nExploitation Method: Remote exploitation is possible because the vulnerable endpoint is accessible via standard HTTP requests. No complex interactions are required beyond reaching the specific file path with the malicious parameter value. The public nature of the exploit means that automated scanners and threat actors can easily target instances of the software.\nPost-Exploitation Impact: Upon successful execution of the injection, an attacker can bypass authentication mechanisms, dump database contents (including user credentials or voting records), modify or delete entries within the database, or, depending on the database configuration, execute administrative commands that result in full system compromise.\nAuthentication and Privileges: The vulnerability allows remote exploitation, typically not requiring complex credentials if the endpoint is exposed. The severity is magnified by the potential for full control over the application's data layer, rendering the application's native security controls ineffective against this class of attack."
}