Description
A vulnerability has been found in SourceCodester Online Voting System 1.0. The affected element is an unknown function of the file /ajax.php?action=delete_voting. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-09-06
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw exists in the Ajax handler for the delete voting operation. A crafted request that alters the ID argument can inject arbitrary SQL. The injected code runs in the context of the database, allowing an attacker to read, modify or delete voting records, thereby compromising the confidentiality, integrity, and availability of election data.

Affected Systems

This vulnerability impacts SourceCodester Online Voting System version 1.0. No other specific affected versions are listed, and no patch has been published by the vendor according to the available information.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.9, reflecting moderate severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. The attack is remote and can be launched via a crafted HTTP request to /ajax.php?action=delete_voting, and the vulnerability has been publicly disclosed, making exploitation a realistic threat.

Generated by OpenCVE AI on September 6, 2026 at 03:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the application to a version that contains the SQL injection fix, or contact SourceCodester for a patch.
  • Validate and sanitize the ID parameter in the delete_voting endpoint; use prepared statements to prevent malicious SQL.
  • Implement a Web Application Firewall with SQL injection detection to block suspicious requests.
  • Restrict access to the delete_voting functionality to authenticated administrators only, and enforce proper authorization checks.

Generated by OpenCVE AI on September 6, 2026 at 03:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 06 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in SourceCodester Online Voting System 1.0. The affected element is an unknown function of the file /ajax.php?action=delete_voting. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Title SourceCodester Online Voting System ajax.php delete_voting sql injection
First Time appeared Sourcecodester
Sourcecodester online Voting System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:online_voting_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester online Voting System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Online Voting System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-06T02:15:12.286Z

Reserved: 2026-09-05T09:48:30.329Z

Link: CVE-2026-86160

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-06T03:17:16.913

Modified: 2026-09-06T03:17:16.913

Link: CVE-2026-86160

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-06T03:30:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')