CVE-2026-86160 in Online Voting System
Summary
by MITRE • 09/06/2026
A vulnerability has been found in SourceCodester Online Voting System 1.0. The affected element is an unknown function of the file /ajax.php?action=delete_voting. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/06/2026
The SourceCodester Online Voting System version 1.0 contains a critical security flaw within its administrative or backend processing logic, specifically located in the file ajax.php when handling the delete_voting action parameter. This vulnerability manifests as an SQL injection weakness arising from improper input validation and sanitization of the ID argument passed to this endpoint. The system fails to properly escape user-supplied data before incorporating it into database queries, allowing attackers to inject malicious SQL commands that can alter or extract sensitive information from the underlying database structure.
This specific instance of SQL injection is classified under CWE-89 Improper Neutralization of Special Elements used in an SQL Command according to common weakness enumeration standards. The root cause lies in the application's failure to use parameterized queries or prepared statements when interacting with the database for voting deletion operations. Instead, the developer likely concatenated user input directly into a string-based query, creating a vector where special characters such as single quotes can break out of the intended command context and execute arbitrary SQL code on the server side.
The operational impact of this vulnerability is severe due to its remote exploitability. An attacker does not require prior authentication or physical access to leverage this flaw, making it accessible over standard network connections via HTTP requests. By manipulating the ID parameter in the ajax.php?action=delete_voting endpoint, a malicious actor can potentially read sensitive data from other database tables, modify voting records to alter election outcomes, delete critical system configurations, or even execute administrative commands on the underlying operating system depending on the database engine's capabilities and privileges.
The fact that an exploit has been publicly disclosed significantly increases the risk landscape for organizations still running this outdated version of the software. Publicly available exploits lower the barrier to entry for attackers who may lack advanced technical skills but can utilize existing tools to compromise systems hosting vulnerable instances. This leads to a high probability of automated scanning and exploitation attempts targeting known signatures associated with SourceCodester projects, resulting in potential data breaches or complete system compromise if left unpatched.
Mitigation strategies must focus on immediate remediation through code modification rather than temporary workarounds alone. The primary fix involves refactoring the affected PHP function to utilize prepared statements with parameterized queries for all database interactions involving user-supplied input. This ensures that the database engine treats input data strictly as values rather than executable code, effectively neutralizing injection attempts. Additionally, implementing strict input validation using allowlists for expected ID formats can provide defense in depth by rejecting any non-numeric or malformed inputs before they reach the query layer.
Beyond immediate patching, organizations should conduct a broader security audit of similar endpoints within the application to identify other potential SQL injection points that may share the same coding pattern. Regular dependency updates and adopting secure development lifecycle practices are essential to prevent recurrence. For systems where immediate code changes are not feasible, deploying a Web Application Firewall with rules tuned to detect common SQL injection patterns can offer temporary protection against exploitation attempts while permanent fixes are developed and deployed.