A flaw in the login handling of the online voting system allows a user to inject an arbitrary SQL statement through the Username field. Because the value is concatenated directly into a database query without proper escaping or parameterization, an attacker can influence the backend query logic, potentially retrieving, modifying, or deleting data. Such an injection can compromise the confidentiality, integrity, and availability of the voting database, allowing unauthorized access to vote counts or election administration data.

The vulnerability affects the SourceCodester Online Voting System, version 1.0. The exposure occurs in the ajax.php script that processes login actions. No other product or version variants are listed as affected by the CNA.

The CVSS score of 6.9 indicates a medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack can be performed remotely simply by sending a crafted HTTP request to the login endpoint. Because the flaw is a traditional SQL injection and the system does not appear to enforce input constraints, exploitation is likely straightforward for an attacker with basic knowledge of web-based injection techniques.