Executive brief
SourceCodester Online Voting System is a PHP-based web application for conducting online voting. An SQL injection vulnerability in the login function allows attackers to manipulate database queries by injecting malicious code into the username parameter, enabling unauthorized database access, data theft, data modification, and complete system compromise without requiring authentication.
Technical details
The vulnerability is an unauthenticated SQL injection in the `/voting/ajax.php?action=login` endpoint affecting the username parameter. The vulnerable code fails to sanitize or parameterize user input before directly concatenating it into SQL queries. An attacker can inject arbitrary SQL code—such as time-based blind SQL injection payloads—to extract database contents, modify or delete records, or bypass authentication. The attack is remotely exploitable via POST requests and requires no prior authentication. No login or authorization is needed to trigger the vulnerability.
Affected products
- SourceCodester Online Voting System 1.0
Timeline
- 2026-07-19: disclosed
- 2026-09-06: advisory