Executive brief
SourceCodester Online Voting System is a web-based application for managing elections. A SQL injection vulnerability in the user management function allows attackers to manipulate database queries without authentication, potentially exposing voter data, modifying election records, or compromising the entire database.
Technical details
A SQL injection vulnerability exists in /voting/ajax.php?action=save_user due to insufficient input validation on the 'id' parameter. The parameter is used directly in SQL queries without sanitization or prepared statements. The vulnerability is remotely exploitable over the network without requiring authentication or user interaction. An attacker can inject boolean-based blind or time-based blind SQL payloads to extract sensitive data, modify database records, or execute arbitrary SQL commands. No patch information is currently available; remediation requires implementing prepared statements with parameter binding and strict input validation.
Affected products
- SourceCodester Online Voting System 1.0
Timeline
- 2026-09-06: disclosed
- other: Exploit published and available; date published: July 19, 2026 (issue opened)