EUVD-2026-72039
GHSA-7hgj-8jr5-jhp5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing Online Voting System instance
-
DeliverySend crafted HTTP POST to /ajax.php?action=save_user
-
ExploitInject SQL payload in unsanitized ID parameter
-
ExecutionExecute arbitrary SQL against backend database
-
ImpactExtract voter records or credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required for exploitation. The CVSS PR:N vector confirms the save_user action on /ajax.php is accessible without authentication, and AV:N/AC:L indicates straightforward network-level access with no unusual constraints. The sole prerequisite is network reachability to a running instance of Online Voting System 1.0. Exploitation is realistically limited by deployment footprint: this is an educational PHP project typically run by students or developers, so publicly internet-exposed instances are atypical but possible. No non-default configuration or specific platform version beyond 1.0 is required. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no special configuration, and no user interaction from any network-reachable host. However, the impact tier (VC:L/VI:L/VA:L) is limited - database-layer read and write, not full system takeover - yielding a score of 6.9 rather than critical. A public PoC exists on GitHub, significantly reducing attacker skill requirements and enabling opportunistic automated scanning. No EPSS data or CISA KEV listing is provided in the input, so widespread active exploitation is not confirmed. The primary realistic threat is database exfiltration of voter personally identifiable information or credentials stored in the application. The small real-world deployment footprint of this educational PHP project limits aggregate exposure, but any internet-facing instance is a realistic target for SQL injection scanners. |
| Exploit ScenarioDerived | An unauthenticated remote attacker submits a crafted HTTP POST request to /ajax.php?action=save_user with a malicious value in the ID parameter containing SQL injection syntax - for example, a UNION SELECT or time-based blind injection payload. A public PoC on GitHub (https://github.com/lwcc223/CVE/issues/1) is available, meaning the attacker requires minimal skill to adapt it. The attacker extracts voter records, credentials, or other sensitive database contents without any prior authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
SQL injection in SourceCodester Online Voting System 1.0 exposes the /ajax.php?action=save_user endpoint to unauthenticated remote exploitation via the unsanitized ID parameter. A public proof-of-concept exploit is available on GitHub, enabling database extraction or manipulation without authentication. The CVSS 4.0 vector confirms network-reachable, zero-prerequisite exploitation, though impact is bounded at the database layer rather than full system compromise.
RemediationAI
No vendor-released patch has been identified at time of analysis. SourceCodester distributes this product as free educational source code without a formal patch lifecycle, so administrators should not expect an upstream fix. The correct code-level fix is replacing dynamic SQL string concatenation in the save_user handler with parameterized queries using PHP PDO or MySQLi prepared statements. As an immediate compensating control, restrict access to /ajax.php via web server ACLs or firewall rules if the endpoint does not need to be publicly reachable. If the application is not actively required, take it offline entirely. Deploying a WAF with SQL injection detection rules (e.g., ModSecurity with the OWASP Core Rule Set) can block common injection payloads but is not a substitute for fixing the underlying code. The VulDB advisory is at https://vuldb.com/vuln/399284.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is a PHP-based web application (CPE: cpe:2.3:a:sourcecodester:online_voting_system:*:*:*:*:*:*:*:*) distributed by SourceCodester as free educational source code for student developers. The root cause is CWE-89 (SQL Injection): the /ajax.php handler for the save_user action constructs SQL queries via string concatenation without sanitizing or parameterizing the ID argument, allowing injected SQL to alter query semantics. This is a textbook unsanitized input flaw in a PHP application that lacks prepared statements or input validation at the database boundary.
Know when Online Voting System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Unauthenticated network SQLi with limited database-layer read/write impact; no scope change or high-severity system compromise demonstrated.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in SourceCodester Online Voting System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_user. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in SourceCodester Online Voting System SQL Injection
View all 4More in Online Voting System
View allSQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via
Projectworld Online Voting System Version 1.0 is vulnerable to Cross Site Request Forgery (CSRF) via voter.php. Rated me
Online Birth Certificate System Project V 1.0 is affected by cross-site scripting (XSS). Rated medium severity (CVSS 6.1
Unauthenticated SQL injection in code-projects Online Voting System 0.x-1.0 exposes the admin login endpoint to full aut
SQL injection in SourceCodester Online Voting System 1.0 allows unauthenticated remote attackers to read and manipulate
A vulnerability was identified in itsourcecode Online Voting System 1.0. Rated medium severity (CVSS 6.9), this vulnerab
A weakness has been identified in itsourcecode Online Voting System 1.0. Rated medium severity (CVSS 5.3), this vulnerab
A vulnerability was detected in itsourcecode Online Voting System 1.0. Rated medium severity (CVSS 5.3), this vulnerabil
A security flaw has been discovered in itsourcecode Online Voting System 1.0. Rated medium severity (CVSS 5.3), this vul
Exploit-DB