Executive brief
SourceCodester Online Voting System is a PHP-based web application for conducting online votes. An unauthenticated attacker can inject malicious SQL code through the 'id' parameter in the category deletion function, allowing unauthorized access to the database, modification or deletion of voting records, and potential complete system compromise without requiring any login credentials.
Technical details
A SQL injection vulnerability exists in the /voting/ajax.php?action=delete_category endpoint where user-supplied input from the 'id' parameter is directly concatenated into SQL queries without sanitization or parameterized query preparation. The vulnerable parameter accepts both boolean-based blind and time-based blind SQL injection payloads, enabling an attacker to extract database contents, modify data, or execute arbitrary SQL commands. The vulnerability is remotely exploitable and requires no authentication or user interaction; attackers need only craft malicious HTTP POST requests with crafted 'id' values. The exploit has been publicly disclosed with proof-of-concept payloads and sqlmap automation. Fix requires implementing prepared statements with parameter binding and strict input validation.
Affected products
- SourceCodester Online Voting System 1.0
Timeline
- 2026-07-19: disclosed
- 2026-09-06: advisory