The vulnerability allows a remote attacker to inject arbitrary SQL statements through the Category parameter in the /voting/ajax.php?action=save_category endpoint. This injection can lead to data exfiltration, modification, or deletion, and in worst case resets the integrity of the voting database or gives the attacker full control over the database. The weakness is a classic SQL injection flaw identified by CWE-89 and improper neutralization of special SQL elements, CWE-74.

SourceCodester Online Voting System 1.0 is affected. The flaw resides in an unknown function that processes the Category argument in the ajax.php file. No other versions or products were listed.

The CVSS base score is 6.9, indicating moderate to high risk. EPSS information is not available, so the likelihood of exploitation is uncertain. The vulnerability is not currently listed in the CISA KEV catalog, but the exploit is publicly available on GitHub, giving attackers ready-to-use code. The attack can be triggered remotely without authentication and may require only a simple HTTP request. Users of this system, especially those without strong input validation or restricted database permissions, face the highest impact.