The flaw lies in the test_input function of the /saveVote.php endpoint, which concatenates values from voterName, voterEmail, voterID, and selectedCandidate directly into an SQL statement without escaping or parameterization, satisfying CWE‑74 and CWE‑89. This permits an attacker to inject arbitrary SQL code, enabling the execution of any SQL statement the database user can run, potentially compromising data confidentiality, integrity, or availability. The CVE description notes that the attack can be initiated remotely, but the specific downstream effects are not detailed; however, standard SQL injection vectors could allow data exfiltration, modification, or deletion. The input sanitization weakness is an endpoint‑level vulnerability that is exploitable by any client capable of sending HTTP requests to the voting system.

Code‑Projects Online Voting System version 1.0 is the only product referenced in the CNA data; no other versions or components are listed as impacted.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is below 1%, implying a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can launch the injection remotely by issuing HTTP requests to /saveVote.php, supplying malicious input that will be executed as part of the unparameterized SQL query.