CVE-2026-86160: Online Voting System 1.0 SQL Injection Flaw

CVE-2026-86160 Overview

CVE-2026-86160 is a SQL injection vulnerability in SourceCodester Online Voting System 1.0. The flaw resides in the /ajax.php?action=delete_voting endpoint, where the ID parameter is passed unsanitized to a backend SQL query. Attackers can manipulate the ID argument to inject arbitrary SQL statements against the underlying database.

The issue is exploitable remotely without authentication or user interaction. Public disclosure of the exploit technique has already occurred, increasing the likelihood of opportunistic scanning and abuse. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote, unauthenticated attackers can inject SQL statements through the ID parameter of delete_voting, exposing voting records, credentials, and administrative data.

Affected Products

SourceCodester Online Voting System 1.0
/ajax.php endpoint handling the delete_voting action
Deployments using the vulnerable ID parameter handler

Discovery Timeline

2026-09-06 - CVE-2026-86160 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86160

Vulnerability Analysis

The vulnerability exists in the AJAX handler responsible for deleting voting records in SourceCodester Online Voting System 1.0. The delete_voting action in /ajax.php accepts an ID parameter that flows directly into a SQL statement without parameterization or input validation. An attacker who supplies crafted SQL syntax in ID can alter query semantics, read arbitrary database contents, or manipulate stored data.

Because the endpoint is reachable over the network and requires no credentials, exploitation can be scripted at scale. The exploit technique has been publicly disclosed through VulDB and a GitHub issue, so proof-of-concept payloads are accessible to opportunistic attackers. Additional context is available in the VulDB entry for CVE-2026-86160 and the public GitHub issue.

Root Cause

The root cause is missing input sanitization and the absence of prepared statements in the delete_voting handler. User-supplied data from the ID request parameter is concatenated into a SQL query string, allowing metacharacters to break out of the expected literal context. This design pattern maps directly to [CWE-74] injection weaknesses.

Attack Vector

Exploitation requires only an HTTP request to the target instance. An attacker sends a GET or POST request to /ajax.php?action=delete_voting with a malicious ID payload such as boolean, union, or time-based SQL injection primitives. Successful injection can enumerate schemas, extract voter data, dump admin credential hashes, or destructively modify records tied to election integrity.

No authenticated session or user interaction is required. See the VulDB submission and the SourceCodester project page for reference details on the affected component.

Detection Methods for CVE-2026-86160

Indicators of Compromise

HTTP requests to /ajax.php?action=delete_voting containing SQL metacharacters such as ', --, UNION, SLEEP(, or SELECT in the ID parameter.
Web server access logs showing unusually long or URL-encoded ID values from a single source address.
Database error messages referencing syntax errors originating from the delete_voting code path.
Unexpected deletions or modifications of voting, voters, or admin tables outside of administrative activity windows.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect the action=delete_voting request and flag SQL keywords or tautologies in the ID parameter.
Enable database query logging and alert on unparameterized statements referencing the voting deletion path.
Correlate spikes in HTTP 500 responses from /ajax.php with client IP reputation data to surface exploitation attempts.

Monitoring Recommendations

Forward web server, application, and database logs to a centralized analytics platform for cross-source correlation.
Baseline normal traffic to /ajax.php and alert on deviations in request rate, parameter length, or geolocation.
Monitor privileged database accounts used by the application for anomalous SELECT volume or schema enumeration queries.

How to Mitigate CVE-2026-86160

Immediate Actions Required

Restrict external access to the Online Voting System administrative and AJAX endpoints using network ACLs or a reverse proxy allowlist.
Deploy WAF rules that block SQL metacharacters in the ID parameter of /ajax.php?action=delete_voting.
Audit database and application logs for prior exploitation attempts against the delete_voting action.
Rotate any credentials, session secrets, and API keys stored in the application database if compromise is suspected.

Patch Information

No official vendor patch is currently referenced in the CVE record. SourceCodester distributes the Online Voting System 1.0 as an open-source PHP project, so remediation typically requires source-level changes. Refactor the delete_voting handler to use parameterized queries (for example, PDO::prepare with bound parameters) and validate that ID is an integer before use. Monitor the SourceCodester security resource and the associated GitHub issue tracker for updates.

Workarounds

Take the application offline if it is not actively required for an election cycle.
Apply server-side input filtering that rejects any non-numeric value for the ID parameter before it reaches the SQL layer.
Enforce least-privilege on the database account used by the application, removing DROP and unnecessary DELETE grants where feasible.
Place the application behind an authenticating reverse proxy to eliminate unauthenticated network exposure.

bash

# Example ModSecurity rule to block SQLi patterns in the vulnerable parameter
SecRule REQUEST_URI "@contains /ajax.php" \
  "chain,phase:2,deny,status:403,id:1026086160,\
   msg:'CVE-2026-86160 SQLi attempt against delete_voting'"
  SecRule ARGS:action "@streq delete_voting" \
    "chain"
    SecRule ARGS:ID "@rx (?i)(union|select|sleep\(|--|';|\bor\b\s+1=1)" "t:none,t:urlDecodeUni"