Description

A vulnerability was determined in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-06T03:17:17.220Z",
  "pubdate": "2026-09-06T03:17:17.220Z",
  "executiveSummary": "The Online Voting System 1.0 is susceptible to a remote SQL injection vulnerability residing within the /ajax.php?action=login endpoint.\nThis security flaw stems from the improper sanitization of the 'Username' parameter before inclusion in database queries.\nSuccessful exploitation allows an unauthenticated, remote attacker to manipulate SQL commands, potentially leading to unauthorized data access, authentication bypass, or full database compromise.\nGiven that exploit code is publicly disclosed, the risk of exploitation is significantly elevated for organizations utilizing this software version.\nThe vulnerability does not require prior authentication, allowing attackers to interact directly with the backend database, compromising the integrity and confidentiality of the voting system's information.",
  "technicalDetails": "The vulnerability is identified as a SQL injection (SQLi) flaw within the SourceCodester Online Voting System 1.0. The root cause is the insecure handling of user-supplied input via the 'Username' parameter in the /ajax.php file when the action is set to 'login'.\nAnalysis indicates that the application fails to utilize parameterized queries or prepared statements when interacting with the database. Consequently, the input provided by a user is directly concatenated into a SQL statement, allowing the injection of arbitrary SQL syntax.\nThe attack flow commences with the attacker sending a specially crafted HTTP request to the /ajax.php endpoint. By appending malicious SQL injection payloads to the 'Username' field, the attacker can break out of the intended query logic. For instance, inputting characters such as single quotes ('), OR statements, or union-based payloads allows the attacker to alter the query structure.\nThrough this manipulation, an attacker can bypass the authentication mechanism by forcing a 'true' condition in the login query, enabling unauthorized access to administrative or user-level sessions. Furthermore, by utilizing UNION SELECT statements, an attacker can extract sensitive information from the database, including user credentials, ballot data, or configuration settings.\nBecause the vulnerability is exposed via the network and accessible without authentication, it possesses a high severity rating. The impact of the exploitation is significant; it threatens the confidentiality of the voter data and the overall integrity of the voting results within the system. Post-exploitation, an attacker may achieve complete control over the database management system (DBMS) depending on the privileges assigned to the database user account used by the application, potentially leading to remote code execution (RCE) on the database host in certain misconfigured environments."
}