Online Voting System CVE-2026-14648

No special conditions are required beyond network access to the login page. The attack targets the default authentication flow at /authentication.php against the adminUserName and adminPassword POST parameters - both of which are present in every standard installation of the application. The CVSS 4.0 vector confirms AV:N/AC:L/AT:N/PR:N/UI:N, meaning no authentication, no elevated complexity, no specific attack target configuration, and no user interaction are required. What limits exploitation in practice is the product's narrow deployment footprint: this is an academic/demonstration project from code-projects.org, so the number of internet-facing production instances is expected to be low. Exploitation is not limited by platform, database backend selection, or any optional feature flag - the vulnerable code path executes on every login attempt.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated, low-complexity remote exploitation with no user interaction - a worst-case access profile. However, the published impact metrics (VC:L/VI:L/VA:L) appear to significantly underestimate the actual impact of a SQL injection on a login endpoint: authentication bypass and full database read/write are realistic outcomes that align with High confidentiality and integrity impact, not Low. This discrepancy between the CVSS access metrics and the reported impact ratings should be noted by security teams and the official score should be treated with caution. The E:P modifier in the CVSS 4.0 vector confirms a public proof-of-concept exists, corroborated by the GitHub gist reference. There is no CISA KEV listing, suggesting no confirmed widespread active exploitation at time of analysis, which is consistent with the product's limited production footprint. EPSS data was not provided; given the niche nature of this product, mass exploitation is unlikely, though targeted attacks against any deployed instances are trivially executable given the public PoC.

An attacker identifies an internet-accessible instance of Online Voting System by searching for the path /authentication.php or the application's characteristic HTML via a search engine or scanner. The attacker submits a crafted payload such as admin' OR '1'='1' -- in the adminUserName POST parameter, which mutates the SQL query into an always-true condition, granting full admin access without a valid password. A public proof-of-concept demonstrating this technique is available at https://gist.github.com/c4ttr4ck/ed954dc2e3da968eb460a18385146f4c.