SQL Injection in SourceCodester Online Voting System

SourceCodester Online Voting System version 1.0 contains a SQL injection vulnerability within the /ajax.php endpoint. The flaw is specifically triggered through the 'id' parameter when the action is set to 'save_user'. An unauthenticated remote attacker can inject arbitrary SQL commands into the application's database queries. This vulnerability is significant because the exploit code has been publicly released, increasing the likelihood of exploitation. Successful exploitation allows an attacker to bypass authentication, extract sensitive voter information, modify database records, or potentially gain further control over the underlying web application environment. Defenders should prioritize auditing web server access logs for requests to the /ajax.php endpoint containing SQL metacharacters.

Impact

Successful exploitation of CVE-2026-86159 allows an attacker to gain unauthorized access to the backend database, potentially leading to the theft of personal voter data, integrity loss of voting records, or total compromise of the application data layer.

Recommendation

1. Deploy a Web Application Firewall (WAF) rule to block requests to '/ajax.php' that contain SQL injection patterns (e.g., UNION, SELECT, OR 1=1) within the 'id' parameter.
2. Audit web server access logs (Apache, Nginx, or IIS) for POST requests to '/ajax.php' where the query string or body contains the 'action=save_user' and 'id' parameters, and inspect these for potential SQL injection strings.
3. Ensure that the web application implements parameterized queries (prepared statements) to neutralize the SQL injection vector, as SourceCodester has not provided a patch for this version.