CVE-2026-86161 in Online Voting System
Summary
by MITRE • 09/06/2026
A vulnerability was found in SourceCodester Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=delete_category. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/06/2026
The SourceCodester Online Voting System version 1.0 contains a critical security flaw within its administrative backend, specifically located in the file ajax.php when processing requests with the action parameter set to delete_category. This vulnerability manifests as an SQL injection weakness resulting from improper validation and sanitization of user-supplied input passed via the ID argument. The application fails to properly escape special characters or utilize prepared statements before incorporating this identifier into database queries, allowing attackers to inject arbitrary SQL commands that are executed by the underlying database management system.
This technical flaw falls under the Common Weakness Enumeration category CWE-89, which defines Improper Neutralization of Special Elements used in an SQL Command. The absence of robust input validation mechanisms means that a remote attacker can manipulate the ID parameter to alter the structure of the intended query. By appending malicious payloads such as UNION SELECT statements or boolean-based logic tricks, an adversary can bypass authentication controls, extract sensitive data from other tables within the database schema, modify existing records, or potentially execute administrative commands depending on the privileges granted to the database user account associated with the web application.
The operational impact of this vulnerability is severe due to its remote exploitability and public availability. Since the affected endpoint is accessible over a network connection, an unauthenticated attacker can launch attacks from any location without prior access credentials if the interface does not enforce strict authentication checks on all AJAX endpoints or if valid session tokens are easily bypassed. The existence of publicly available exploits significantly lowers the barrier to entry for malicious actors, increasing the likelihood of automated scanning and exploitation attempts against systems running this specific version of the software. Successful exploitation can lead to full database compromise, including the exposure of voter information, administrator credentials, and other confidential data stored within the system.
To mitigate this risk, immediate remediation is required by updating the source code in ajax.php to implement parameterized queries or prepared statements for all SQL operations involving user-supplied input. Developers should also enforce strict type checking on the ID argument to ensure it accepts only expected integer values and apply comprehensive output encoding where necessary. Additionally, implementing a Web Application Firewall can provide an additional layer of defense by detecting and blocking common SQL injection patterns in HTTP requests. It is strongly recommended that organizations using this voting system upgrade to a patched version or replace the software with a more secure alternative until these code-level fixes are applied and verified through thorough penetration testing.