Executive brief
SourceCodester Online Voting System is a PHP-based application for managing online voting. A SQL injection vulnerability in the category parameter of /voting/ajax.php allows remote attackers to execute arbitrary SQL queries without authentication, potentially exposing, modifying, or deleting sensitive voting data and system information.
Technical details
A SQL injection vulnerability exists in the /voting/ajax.php file with the action=save_category parameter, specifically in the 'category' POST parameter. The vulnerable component fails to properly sanitize or validate user input before incorporating it directly into SQL queries. The attack vector is network-based and requires no authentication or special privileges. Attackers can inject malicious SQL code (demonstrated via time-based blind SQL injection with SLEEP payloads) to extract sensitive data, modify database records, or achieve comprehensive database control. No known patch or official fix has been released as of the advisory date.
Affected products
- SourceCodester Online Voting System 1.0
Timeline
- 2026-07-18: disclosed
- 2026-09-07: advisory