Executive Summary
A SQL injection vulnerability, CVE-2026-86290, has been disclosed in SourceCodester Online Voting System 1.0. The flaw lives in /voting/ajax.php?action=save_category, where the Category parameter is passed into a database query without sanitization. The vulnerability is remotely exploitable, requires no authentication, and a public exploit is already available.
CVSS 3.1 Score: 7.3 (High)
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-86290 |
| CVSS 3.1 Score | 7.3 (High) |
| CVSS 4.0 Score | 6.9 (Medium) |
| Type | SQL Injection (CWE-89) |
| Attack Vector | Network — remote, unauthenticated |
| Affected Endpoint | /voting/ajax.php?action=save_category |
| Affected Parameter | Category |
| Exploit Availability | Public exploit published on GitHub |
| Assigner | VulDB |
Affected Versions
| Product | Affected Versions | Fixed Version |
|---|---|---|
| SourceCodester Online Voting System | 1.0 | None available |
No vendor patch currently exists for this product.
Technical Details
The save_category action within ajax.php accepts a Category value and concatenates it directly into an SQL statement without parameterization or escaping. Because the endpoint enforces no session or authentication check, any remote, unauthenticated visitor can reach it directly.
1. Attacker sends a crafted request to
/voting/ajax.php?action=save_category with a malicious
Category parameter
2. No authentication or session cookie is required to reach
the endpoint
3. The unsanitized value is concatenated directly into the
backing SQL query
4. A crafted payload allows extraction, modification, or
deletion of database contentsExploitation is rated as easy by VulDB, with technical details and a working proof-of-concept exploit already publicly available.
Impact of Successful Exploitation
| Impact | Description |
|---|---|
| Data Exfiltration | Dump voter, candidate, and administrator records from the underlying database |
| Data Tampering | Insert, modify, or delete voting categories and related records |
| Election Integrity | Manipulate category or ballot data used by the voting workflow |
| Credential Exposure | Recovered database credentials could be reused against other systems |
Mitigation
- Restrict access to
/voting/ajax.phpat the web server or firewall level until a fix is available. - Rewrite the query behind the
save_categoryaction to use prepared statements with bound parameters instead of string concatenation. - Enforce authentication on all
ajax.phpactions that modify data —save_categorycurrently accepts unauthenticated requests. - Validate the
Categoryinput server-side, rejecting unexpected characters and enforcing type/length constraints. - Apply WAF rules to catch common SQLi patterns (
UNION SELECT,OR 1=1, quote-based probing) targeting this endpoint. - Minimize database account privileges for the web application to limit the blast radius of a successful injection.
This disclosure follows a broader pattern of SQL injection issues surfacing across SourceCodester products in recent weeks, including a related but distinct flaw in the same vendor's Class and Exam Timetabling System. Administrators running any SourceCodester PHP application should treat unauthenticated ajax.php endpoints as unaudited and likely vulnerable until proven otherwise.
Detection Indicators
| Indicator | Description |
|---|---|
Requests to /voting/ajax.php?action=save_category without a valid session | Authentication-bypass or injection probing |
Quote characters, UNION SELECT, or OR 1=1 in the Category parameter of logged requests | Injection attempt |
| Unexpected changes to voting category records | Possible successful exploitation |