CVE-2025-11667: Fabian Automated Voting System SQL Injection

CVE-2025-11667 Overview

CVE-2025-11667 is a SQL injection vulnerability affecting code-projects Automated Voting System 1.0. The flaw resides in the /admin/add_candidate_modal.php file, where the firstname parameter is passed to a database query without proper sanitization. Authenticated attackers can manipulate this parameter to inject arbitrary SQL statements. The vulnerability is exploitable remotely over the network and the exploit details have been disclosed publicly. The issue is categorized under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command and [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Remote authenticated attackers can inject SQL statements through the firstname parameter, potentially exposing or modifying voting system data.

Affected Products

code-projects Automated Voting System 1.0
Component: /admin/add_candidate_modal.php
Vulnerable parameter: firstname

Discovery Timeline

2025-10-13 - CVE-2025-11667 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-11667

Vulnerability Analysis

The vulnerability exists in the candidate registration workflow of the Automated Voting System administrative interface. The add_candidate_modal.php script accepts the firstname parameter from user input and concatenates it directly into a SQL query string. Because the application does not employ parameterized queries or input sanitization, attacker-supplied SQL syntax executes within the database context.

Exploitation requires low-privileged authentication, as the vulnerable endpoint resides under /admin/. Once authenticated, an attacker can submit a crafted firstname value to alter query logic, enumerate database contents, or manipulate stored records including candidate and voter data.

The exploit has been publicly disclosed through the GitHub CVE Issue Tracker and tracked in VulDB #328087. The EPSS probability is 0.395% with a percentile rank of 31.07.

Root Cause

The root cause is the absence of prepared statements or parameter binding when processing the firstname POST parameter. User-controlled input flows directly into a dynamically constructed SQL INSERT or SELECT query. PHP applications using mysqli_query or mysql_query with string concatenation remain vulnerable when input is not escaped using mysqli_real_escape_string or, preferably, parameterized via PDO.

Attack Vector

The attack vector is network-based and requires the attacker to hold low-level credentials to reach the admin candidate management form. An attacker submits a malicious payload such as a UNION-based or boolean-based SQL injection in the firstname field of the add candidate modal. The injected SQL executes against the backend MySQL database, returning data through error messages, timing differences, or modified application output.

Further technical detail and proof-of-concept artifacts are documented in the VulDB submission #673203.

Detection Methods for CVE-2025-11667

Indicators of Compromise

HTTP POST requests to /admin/add_candidate_modal.php containing SQL metacharacters such as single quotes, UNION SELECT, OR 1=1, or -- comment sequences in the firstname field
Unexpected database errors logged by the web server referencing the candidate insertion query
Anomalous outbound database queries or table enumeration from the voting application service account
New or modified rows in candidate or user tables outside of normal administrative workflows

Detection Strategies

Deploy web application firewall signatures that flag SQL injection patterns targeting the firstname parameter on the candidate modal endpoint
Enable verbose query logging on the backend MySQL instance and alert on queries containing tautologies or stacked statements originating from the voting application
Correlate authentication logs with subsequent admin form submissions to detect compromised low-privilege accounts probing injection points

Monitoring Recommendations

Monitor access logs for repeated POST requests to /admin/add_candidate_modal.php from a single source within a short time window
Track HTTP 500 responses and database error pages, which often indicate injection probing
Baseline normal admin user behavior and alert on deviations such as off-hours candidate additions or bulk record changes

How to Mitigate CVE-2025-11667

Immediate Actions Required

Restrict access to the /admin/ directory using network-level controls or IP allowlists until a code fix is applied
Audit existing administrative accounts and rotate credentials for any accounts with access to the candidate management interface
Review the database for unauthorized candidate entries or schema modifications and restore from a known-good backup if tampering is detected
Deploy WAF rules to block SQL injection payloads targeting the firstname parameter

Patch Information

No official vendor patch has been published for code-projects Automated Voting System 1.0 at the time of NVD publication. Administrators should consult the code-projects resource page for any future releases. In the absence of a vendor patch, organizations running this software in production should consider migrating to a maintained voting platform or applying source-level remediation by replacing string-concatenated queries with prepared statements using PDO or mysqli with parameter binding.

Workarounds

Modify add_candidate_modal.php to use parameterized queries with bound parameters instead of string concatenation
Apply server-side input validation that rejects non-alphabetic characters in name fields before they reach the database layer
Run the application database account with the minimum privileges necessary, removing rights to drop tables or read sensitive schemas
Place the application behind a reverse proxy with SQL injection filtering enabled

bash

# Example PHP remediation using PDO prepared statements
$stmt = $pdo->prepare("INSERT INTO candidates (firstname, lastname) VALUES (:firstname, :lastname)");
$stmt->bindParam(':firstname', $firstname, PDO::PARAM_STR);
$stmt->bindParam(':lastname', $lastname, PDO::PARAM_STR);
$stmt->execute();