CVE-2026-86159: Online Voting System 1.0 SQL Injection Flaw

CVE-2026-86159 Overview

CVE-2026-86159 is a SQL injection vulnerability in SourceCodester Online Voting System 1.0. The flaw resides in the /ajax.php?action=save_user endpoint, where the ID parameter is passed to backend database queries without proper sanitization. Attackers can manipulate the ID argument to inject arbitrary SQL statements against the underlying database. The vulnerability is remotely exploitable and requires no authentication or user interaction. Public exploit details have been disclosed, increasing the likelihood of opportunistic scanning and exploitation. The weakness is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can inject arbitrary SQL into the save_user action, potentially disclosing, modifying, or deleting voter records and administrative credentials.

Affected Products

SourceCodester Online Voting System 1.0
/ajax.php endpoint handling the save_user action
Deployments exposing the application to untrusted networks

Discovery Timeline

2026-09-06 - CVE-2026-86159 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86159

Vulnerability Analysis

The vulnerability exists in the user management workflow of SourceCodester Online Voting System 1.0. The /ajax.php handler dispatches requests based on the action parameter. When action=save_user is invoked, the server-side logic accepts an ID argument used to identify the user record being created or updated. That argument is concatenated into a SQL statement without parameterized binding or input validation. As a result, attacker-supplied SQL fragments are executed by the database engine with the privileges of the application's database account.

Because the Online Voting System stores voter data, ballots, and administrative credentials in the same database, successful injection can compromise the integrity of election-related data. Attackers can enumerate schemas, extract password hashes, or alter voting records depending on database permissions.

Root Cause

The root cause is improper neutralization of special elements passed through the ID parameter. The application does not use prepared statements or type coercion before including the value in a query, which allows SQL metacharacters to break out of the intended context.

Attack Vector

Exploitation occurs over the network by issuing a crafted HTTP request to /ajax.php?action=save_user with a manipulated ID value. No authentication or user interaction is required. A public disclosure describing the exploit has been referenced in the GitHub CVE Issue Discussion and the VulDB Vulnerability Detail.

No verified proof-of-concept code has been reproduced here. The vulnerability manifests as unsanitized concatenation of the ID parameter into a SQL query executed by the save_user handler. Consult the referenced advisories for technical detail.

Detection Methods for CVE-2026-86159

Indicators of Compromise

HTTP requests to /ajax.php?action=save_user containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the ID parameter.
Web server or PHP error logs showing SQL syntax errors originating from the save_user action.
Unexpected creation, modification, or deletion of records in user or voter tables.
Outbound database connections or long-running queries triggered by requests to ajax.php.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the ID parameter on /ajax.php for SQL injection payloads.
Enable database query logging and alert on queries containing tautologies such as OR 1=1 or UNION SELECT originating from the application account.
Correlate anomalous save_user request volume with authentication and administrative activity in the application.

Monitoring Recommendations

Monitor HTTP access logs for repeated requests to /ajax.php?action=save_user from a single source.
Track response-time anomalies that may indicate time-based blind SQL injection using SLEEP() or BENCHMARK().
Alert on newly created administrative accounts within the Online Voting System user table.

How to Mitigate CVE-2026-86159

Immediate Actions Required

Restrict network access to the Online Voting System to trusted administrators until a fix is applied.
Place the application behind a WAF with rules that block SQL injection patterns targeting /ajax.php.
Review the users table for unauthorized accounts and reset all administrative credentials.
Audit application and database logs for prior exploitation attempts referencing the save_user action.

Patch Information

As of the last NVD update on 2026-09-08, no official vendor patch is referenced for SourceCodester Online Voting System 1.0. Operators should monitor the SourceCodester Security Resources and the VulDB CVE Report for remediation guidance. In the interim, apply source-level fixes by replacing string concatenation with parameterized queries in the save_user handler.

Workarounds

Modify ajax.php to cast the ID parameter to an integer before use, for example using intval($_POST['ID']).
Refactor database access to use PDO prepared statements or mysqli parameter binding.
Deny direct access to /ajax.php from untrusted networks using web server access controls.
Run the application's database account with least privilege, removing DROP, ALTER, and FILE rights.

bash

# Example Apache configuration to restrict /ajax.php to an internal management network
<Location "/ajax.php">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>