The SourceCodester Online Voting System 1.0 contains a flaw in an unnamed function within the file /ajax.php?action=delete_category. By manipulating the ID parameter, an attacker can inject arbitrary SQL statements into the database query. This SQL injection vulnerability allows remote exploitation and can give the attacker unauthorized read or write access to the database, potentially exposing sensitive voter data or altering election results.

The affected product is SourceCodester's Online Voting System, version 1.0. No other versions are mentioned, so the impact is limited to the 1.0 release.

The CVSS score of 6.9 ranks the issue as medium severity, and while the EPSS score is not available, the public availability of a working exploit indicates a realistic threat. The vulnerability is exploitable over the network through normal HTTP requests to the delete_category endpoint, and the lack of authentication restrictions in the description suggests that the attack vector is remote. Given its remote execution potential, administrators should consider applying the most recent patch or mitigating controls promptly.