Online Voting System EUVD-2026-72318

No special conditions are required for exploitation - the vulnerable endpoint /voting/ajax.php?action=save_category is exposed to unauthenticated remote HTTP requests in a default deployment of SourceCodester Online Voting System 1.0. The CVSS 4.0 vector (PR:N, UI:N, AC:L, AT:N) confirms there are no authentication, interaction, or complexity prerequisites. What limits real-world exposure is the narrow deployment footprint: this is a demo/academic application primarily used in student coursework and small-scale educational or proof-of-concept settings, not a commercial product deployed at scale. Network-level reachability to the PHP web server hosting the application is the only practical prerequisite.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms unauthenticated network-accessible exploitation with zero attack complexity, which is the highest possible accessibility for any vulnerability. However, the provided CVSS 4.0 base score of 5.5 reflects VC:L/VI:L/VA:L impact metrics, which appears to understate a typical SQL injection outcome - a successful injection against an unprotected database generally yields full confidentiality and integrity compromise, not merely partial impact; this discrepancy should be flagged for review by any team relying on these metrics. A public proof-of-concept is available on GitHub, which dramatically lowers the exploitation barrier and makes automated scanning attacks plausible. No EPSS data was provided, but the combination of PR:N, AC:L, and public PoC code is consistent with a high exploitation probability profile. CISA KEV listing is absent, meaning confirmed active exploitation has not been recorded, though that is not a reliable safety signal for a trivially exploitable class. Even a mid-sized municipal IT team in swidnica operating this system for a local election should treat this as urgent given the sensitivity of voting data and the credibility of the public exploit.

An unauthenticated attacker sends an HTTP POST request to /voting/ajax.php?action=save_category with a SQL payload embedded in the Category parameter, such as a UNION SELECT statement or a time-based blind injection string. The unsanitized input executes within the application's database context, allowing extraction of all records including voter credentials and ballot data. A public proof-of-concept on GitHub demonstrates this technique, making exploitation accessible to low-skilled attackers.