The vulnerability lies in the test_input function of authentication.php in the Online Voting System’s Login component. Unsanitized adminUserName and adminPassword values are directly concatenated into SQL queries, creating a classic SQL injection flaw classified as CWE‑74 and CWE‑89. An attacker can inject arbitrary SQL through the login interface, potentially gaining unauthorized database access and manipulating vote records, data, or other application functionality. The CVE description does not specify the precise data exposed, but typical SQL injection outcomes include compromise of confidentiality, integrity, or availability of the system’s data.

code‑projects Online Voting System versions up to 0.x and 1.0 inclusive are affected. Administrators should verify whether their deployments match or are older than these thresholds, as no newer patched releases are listed in the available data.

With a CVSS score of 6.9, the flaw is rated moderate‑to‑high severity. The EPSS score of less than 1 % indicates a low current likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. Attackers can trigger the vulnerability remotely by submitting crafted login requests; only access to the public login endpoint is required, making the attack vector available to unauthenticated users. The lack of a public exploit in the provided advisory suggests limited known operational misuse so far, but the potential for widespread impact remains if the underlying database is accessed and community vote integrity is at risk.