CVE-2026-86161: Online Voting System SQL Injection Flaw

CVE-2026-86161 Overview

CVE-2026-86161 is a SQL injection vulnerability in SourceCodester Online Voting System 1.0. The flaw resides in the /ajax.php?action=delete_category endpoint, where the ID parameter is passed to a database query without proper sanitization. Remote attackers can manipulate the argument to alter query logic and access or modify backend database records. The exploit has been published, lowering the barrier for opportunistic attackers to weaponize it against unpatched deployments. This weakness is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Remote, unauthenticated attackers can inject arbitrary SQL statements via the ID parameter, exposing voting records, credentials, and administrative data.

Affected Products

SourceCodester Online Voting System 1.0
/ajax.php component handling the delete_category action
Deployments exposing the application to untrusted networks

Discovery Timeline

2026-09-06 - CVE-2026-86161 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86161

Vulnerability Analysis

The vulnerability is a classic SQL injection reachable over the network without authentication or user interaction. The delete_category action in /ajax.php accepts an ID value from the HTTP request and concatenates it directly into a SQL DELETE statement. Because the parameter is not validated, cast to an integer, or bound as a parameterized query, attackers can inject SQL syntax that changes the meaning of the executed query.

Successful exploitation can lead to unauthorized data reads, tampering with categories or ballots, deletion of database rows, and in chained scenarios, extraction of administrator credentials. In an online voting context, integrity of election data is the primary concern; SQL injection here directly undermines that integrity.

Root Cause

The root cause is improper neutralization of user-supplied input before it is used in a SQL statement, mapped to [CWE-74]. The delete_category handler trusts the ID argument and passes it to the database layer as part of a dynamically built query string rather than using prepared statements with bound parameters.

Attack Vector

Exploitation is remote and unauthenticated. An attacker sends a crafted HTTP request to /ajax.php?action=delete_category with a malicious ID value containing SQL payloads. Because a public proof of concept is available through the GitHub CVE Issue Discussion and VulDB CVE Details, commodity scanners and automated tooling can weaponize the flaw at scale.

Refer to the VulDB Vulnerability Information for additional technical context. No verified sanitized exploit code is reproduced here.

Detection Methods for CVE-2026-86161

Indicators of Compromise

HTTP requests to /ajax.php?action=delete_category containing SQL meta-characters such as single quotes, UNION, SLEEP(, --, or ; within the ID parameter.
Unexpected DELETE, SELECT, or UNION queries appearing in database logs originating from the web application service account.
Sudden disappearance of category, candidate, or voter records without a corresponding administrative action.
Web server access logs showing high-volume automated probing of /ajax.php endpoints from a single source.

Detection Strategies

Deploy web application firewall rules that match SQL injection patterns on the ID parameter of /ajax.php.
Enable database query logging and alert on syntactically anomalous queries against the voting system schema.
Correlate web access logs with database audit logs to surface parameter tampering followed by unusual query execution.
Baseline normal request patterns to /ajax.php and flag deviations in parameter length, encoding, or character set.

Monitoring Recommendations

Continuously monitor outbound connections from the web application host for signs of data exfiltration following suspicious requests.
Track authentication failures and privilege changes on database accounts used by the voting application.
Retain web and database logs for a period sufficient to support incident investigation and forensic reconstruction.

How to Mitigate CVE-2026-86161

Immediate Actions Required

Restrict network exposure of the Online Voting System 1.0 application to trusted networks or place it behind a VPN until a fix is applied.
Deploy a web application firewall rule blocking non-numeric input to the ID parameter on /ajax.php?action=delete_category.
Audit database logs for evidence of prior exploitation, focusing on unexpected DELETE and UNION statements.
Rotate database credentials and administrator passwords if compromise is suspected.

Patch Information

No official vendor patch has been referenced in the enriched CVE data. Administrators should monitor the SourceCodester Resource Hub and the GitHub CVE Issue Discussion for remediation guidance. In the absence of a vendor fix, apply source-level hardening by replacing string concatenation in the delete_category handler with parameterized queries and enforcing server-side integer validation on the ID argument.

Workarounds

Cast the ID parameter to an integer server-side before it reaches the SQL layer, rejecting any non-numeric input.
Apply the principle of least privilege to the database account used by the application, removing DROP and ALTER rights.
Disable or remove the delete_category action if the functionality is not required for production use.
Add rate limiting and request signing to administrative AJAX endpoints to reduce the automated exploitation surface.

bash

# Example WAF rule (ModSecurity) to enforce numeric ID on the vulnerable endpoint
SecRule REQUEST_URI "@contains /ajax.php" \
  "chain,phase:2,deny,status:400,id:1026086161,msg:'Block non-numeric ID on delete_category'"
  SecRule ARGS:action "@streq delete_category" "chain"
  SecRule ARGS:ID "!@rx ^[0-9]+$"