Description

A weakness has been identified in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /voting/ajax.php?action=save_category. This manipulation of the argument Category causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-07T09:17:17.650Z",
  "pubdate": "2026-09-07T09:17:17.650Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in SourceCodester Online Voting System 1.0. The vulnerability exists within the /voting/ajax.php file, specifically targeting the save_category function via the Category argument.\nThe flaw allows unauthenticated or authenticated remote attackers to inject malicious SQL commands into the application's backend database. By manipulating the input parameter, an attacker can bypass security controls to read, modify, or delete sensitive data stored within the database.\nThis vulnerability poses a significant risk to the integrity and confidentiality of the application, as it could facilitate unauthorized data access or complete database compromise. The availability of public exploit code significantly increases the probability of exploitation by malicious actors targeting this specific product.\nOrganizations using this version of the Online Voting System are at high risk until effective input sanitization or parameterized queries are implemented.",
  "technicalDetails": "The root cause of this vulnerability is improper neutralization of special elements used in an SQL command within the save_category function of /voting/ajax.php. The application fails to adequately sanitize or parameterize user-supplied input provided through the Category argument before including it in an SQL query execution.\nThe attack flow begins when an attacker sends a crafted HTTP request to the /voting/ajax.php endpoint. By appending a malicious SQL payload to the Category parameter, the attacker can alter the structure of the intended SQL query. For instance, an attacker could utilize UNION-based SQL injection techniques to retrieve data from other tables, or blind SQL injection to infer data based on application responses.\nBecause the input is processed server-side without validation, the database engine executes the injected SQL commands with the permissions of the database user configured for the application. This interaction typically occurs over the network, allowing for remote exploitation without requiring direct access to the server's file system or administrative console.\nThe payload behavior involves the injection of SQL operators and commands such as OR 1=1 or UNION SELECT, which manipulate the logic of the database query. Successful exploitation can lead to unauthorized data exfiltration, bypassing of authentication mechanisms, or modification of the underlying database schema. In some configurations, if the database user has sufficient privileges, an attacker might be able to escalate privileges or interact with the operating system via database features.\nThe vulnerability is present in SourceCodester Online Voting System 1.0. As there is no documented input validation or output encoding on the affected argument, the application remains susceptible to standard SQL injection vectors. Given that exploit code is publicly available, the barrier to entry for an attacker is minimal, requiring only the ability to send standard web requests to the vulnerable endpoint."
}