SQL Injection in SourceCodester Online Voting System Risks Election Data

Executive Summary

A SQL injection vulnerability (CVE-2026-86159) has been disclosed in SourceCodester's Online Voting System 1.0. The flaw affects an unnamed function reachable at /ajax.php?action=save_user, where the ID parameter is passed into a database query without sanitization. Exploitation requires no authentication and is described as easy to carry out; a public proof-of-concept exploit is already available.

CVSS Score: 7.3 (High, CVSS 3.1) / 6.9 (Medium, CVSS 4.0)

An attacker who successfully exploits this flaw can read, alter, or destroy application data — including voter records, administrator accounts, and voting configuration — putting both data confidentiality and the integrity of any hosted vote at risk.

Vulnerability Overview

Affected Versions

This CVE is part of a cluster of related SQL injection flaws disclosed in the same product around the same date, including issues in delete_voting, delete_category, and login actions of the same ajax.php endpoint. Deployments of this codebase should treat the entire ajax.php action dispatcher as untrusted until a comprehensive fix lands.

Attack Vector

1. Attacker identifies a deployment of SourceCodester Online Voting System 1.0
2. Attacker sends a request to ajax.php?action=save_user with a crafted ID parameter
   containing SQL injection payloads (e.g. UNION-based or boolean-based injection)
3. The application concatenates the unsanitized ID value directly into a SQL query
4. The database executes the attacker-controlled query
5. Attacker extracts, modifies, or deletes data — voter records, admin
   credentials, ballots, or configuration — depending on query used

Impact of Successful Exploitation

Immediate Remediation

Since this is unmaintained/demonstration software with no official patch, mitigation is compensating-control based:

1. Take affected deployments offline if used for any live or planned voting process
2. Place a WAF in front of the application with SQL injection rule sets enabled, if it must stay online for any reason
3. Restrict access to ajax.php at the web server level to only the parameters/actions actually required
4. Migrate to parameterized queries / prepared statements for all ID-driven actions if you maintain a fork of this codebase
5. Audit existing data for signs of prior tampering if the application has been internet-facing

Detecting Exploitation Attempts

# Watch access logs for SQL injection patterns targeting the save_user action
grep -i "ajax.php?action=save_user" /var/log/nginx/access.log | grep -iE "union|select|--|;--|or 1=1"

Detection Indicators

Post-Remediation Steps

1. Do not use this codebase for any real election or vote given the pattern of unpatched injection flaws across multiple actions
2. If a fork must remain in production, rewrite all database access to use prepared statements
3. Restore from a known-good backup if tampering is suspected
4. Rotate all administrator credentials
5. Add input validation and a WAF layer as defense in depth even after code-level fixes

References

• VulDB — CVE-2026-86159 SourceCodester Online Voting System ajax.php save_user SQL Injection
• RedPacket Security — CVE Alert: CVE-2026-86159
• OffSeq Threat Radar — CVE-2026-86159 SQL Injection in SourceCodester Online Voting System
• NIST NVD — CVE-2026-86159

Related Reading

• WCFM Marketplace SQL Injection
• Critical Auth Bypass in Tutor LMS Pro Exposes 30,000+