CVE-2025-7151 in Advanced Online Voting System
Summary
by MITRE • 07/08/2025
A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/voters_add.php. The manipulation of the argument photo leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/10/2026
The Campcodes Advanced Online Voting System version 1.0 contains a critical vulnerability in its administrative component that poses significant security risks to electoral infrastructure. This vulnerability exists within the file /admin/voters_add.php which handles voter registration processes through the administrative interface. The flaw specifically relates to improper input validation and sanitization of file upload parameters, particularly the photo argument field that processes user-submitted image files.
The technical implementation of this vulnerability stems from inadequate validation mechanisms that fail to properly inspect or restrict the types of files being uploaded to the system. When an attacker submits a file through the photo parameter in the voters_add.php endpoint, the system does not adequately verify the file extension, MIME type, or file content to ensure it conforms to expected image formats. This lack of proper validation creates an unrestricted upload condition that allows malicious actors to bypass security controls and upload arbitrary files, including potentially harmful executables or scripts that could compromise the entire voting system infrastructure.
The remote exploitation capability of this vulnerability significantly amplifies its danger, as attackers can leverage this weakness from external networks without requiring physical access to the system. The fact that a public exploit has been disclosed means that threat actors with basic technical knowledge can readily deploy attacks against affected systems, potentially leading to complete system compromise. This vulnerability directly maps to CWE-434 Unrestricted Upload of File and aligns with ATT&CK technique T1195.001 for the use of content injection attacks through file upload mechanisms.
The operational impact of this vulnerability extends beyond simple data theft or corruption, as it could fundamentally compromise the integrity and security of an entire online voting system. An attacker who successfully exploits this vulnerability could potentially gain unauthorized access to voter databases, manipulate electoral processes, or establish persistent backdoors within the voting infrastructure. The compromised system could also serve as a launch point for further attacks against connected networks or other systems within the electoral organization's ecosystem.
Organizations utilizing this voting system should immediately implement multiple layers of mitigation strategies including restrictive file type validation, mandatory content inspection of uploaded files, and comprehensive access controls for administrative endpoints. Network-level protections such as web application firewalls and intrusion detection systems should be deployed to monitor for suspicious upload activities. The most effective immediate remediation involves implementing strict file extension filtering, validating MIME types, and ensuring that uploaded files are stored in non-executable directories with proper permissions. Additionally, regular security audits and penetration testing should be conducted to identify similar vulnerabilities in other system components and ensure comprehensive protection against future exploitation attempts.