Executive brief
SourceCodester Online Voting System is a PHP/MySQL web application used to manage online voting processes. A SQL injection vulnerability in the voting deletion functionality allows unauthenticated attackers to manipulate database queries, potentially exposing sensitive voter data, altering voting records, or disrupting the voting system entirely.
Technical details
A SQL injection vulnerability exists in the `/voting/ajax.php?action=delete_voting` endpoint where the `id` parameter is inserted directly into SQL queries without proper sanitization or prepared statements. The vulnerability is accessible without authentication and can be exploited via POST requests using boolean-based blind or time-based blind techniques. Attackers can craft malicious SQL payloads to extract database contents, modify data, or gain system control. The fix requires implementation of prepared statements with parameter binding, strict input validation, and adherence to the principle of least privilege for database credentials.
Affected products
- SourceCodester Online Voting System 1.0
Timeline
- 2026-07-19: disclosed
- 2026-09-06: published
- 2026-09-06: advisory