CVE-2026-86290: Online Voting System 1.0 SQLi Vulnerability

CVE-2026-86290 Overview

CVE-2026-86290 is a SQL injection vulnerability in SourceCodester Online Voting System 1.0. The flaw resides in the /voting/ajax.php?action=save_category endpoint, where the Category parameter is passed unsanitized into a database query. Remote attackers can manipulate this parameter to inject arbitrary SQL statements without authentication. A public exploit has been disclosed, increasing the likelihood of opportunistic attacks against exposed installations. The weakness is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can inject SQL statements through the Category parameter to read, modify, or destroy voting system data.

Affected Products

SourceCodester Online Voting System 1.0
Deployments exposing /voting/ajax.php
Web applications reusing the vulnerable save_category handler

Discovery Timeline

2026-09-07 - CVE-2026-86290 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86290

Vulnerability Analysis

The vulnerability exists in the category-saving handler exposed at /voting/ajax.php?action=save_category. The application concatenates the Category request parameter directly into a SQL statement without parameterization or input filtering. An attacker can supply crafted SQL syntax through the parameter to alter the query logic executed by the backend database.

Exploitation requires no authentication and no user interaction. Because the endpoint is reachable over the network, attackers can automate scanning and mass-exploitation against publicly exposed instances. Successful injection can expose voter records, tamper with election categories, or corrupt the underlying database.

Root Cause

The root cause is missing input neutralization when constructing SQL queries from user-controlled data. The save_category action treats the Category value as trusted string input and inserts it into the query string. This matches the pattern described by [CWE-74], where downstream components interpret unsanitized input as executable syntax.

Attack Vector

An attacker sends a crafted HTTP POST or GET request to /voting/ajax.php?action=save_category with a malicious payload in the Category field. Typical payloads use UNION-based, boolean-based, or time-based injection techniques to extract data or infer schema. Because the flaw is present in an AJAX endpoint, exploitation can be trivially scripted with common HTTP clients.

The vulnerability described in the GitHub Issue Discussion and the VulDB CVE Entry confirms that a public proof-of-concept has been published.

Detection Methods for CVE-2026-86290

Indicators of Compromise

HTTP requests to /voting/ajax.php?action=save_category containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP(.
Anomalous database errors or unusually long response times from the voting application.
Unexpected new or modified rows in the category table or related voting tables.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect the Category parameter for SQL injection patterns.
Enable database query logging and alert on syntactically unusual statements originating from the voting application account.
Correlate access logs with authentication events to flag unauthenticated POST activity to save_category.

Monitoring Recommendations

Monitor outbound data volumes from the database server for signs of bulk extraction.
Track HTTP 500 responses from ajax.php as a proxy for injection probing.
Review web server logs for scanner user-agents targeting SourceCodester paths.

How to Mitigate CVE-2026-86290

Immediate Actions Required

Restrict network access to the Online Voting System until a fix is applied, using IP allowlists or VPN gating.
Disable or firewall the /voting/ajax.php?action=save_category endpoint if the category management feature is not required.
Rotate database credentials used by the application and audit recent category records for tampering.

Patch Information

No official vendor patch is referenced in the available advisory data. Review the VulDB Vulnerability Details and the SourceCodester Resource Hub for updates. Until a patch is released, apply source-level fixes by rewriting the save_category handler to use parameterized queries.

Workarounds

Introduce a WAF rule blocking SQL metacharacters in the Category parameter.
Modify the PHP handler to bind the Category value with PDO::prepare or mysqli_prepare instead of string concatenation.
Enforce least-privilege database accounts so the application user cannot execute DROP, ALTER, or cross-database queries.

bash

# Example ModSecurity rule to block SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@contains /voting/ajax.php" \
  "chain,id:1026086290,phase:2,deny,status:403,msg:'CVE-2026-86290 SQLi attempt'"
  SecRule ARGS:Category "@detectSQLi" "t:none,t:urlDecodeUni"