Online Voting System vulnerabilities

A vulnerability was found in code-projects Online Voting System 1.0 in the file /saveVote.php. The test_input function fails to properly sanitize user input, allowing SQL injection via the voterName, voterEmail, voterID, and selectedCandidate parameters. The attack can be performed remotely.

A SQL injection vulnerability was found in the Online Voting System up to version 1.0 in the test_input function of /authentication.php (Login component). Manipulating adminUserName/adminPassword arguments allows remote SQL injection.

SQL Injection vulnerability in itsourcecode Online Voting System 1.0. Attack via manipulation of id/category argument in /index.php?page=categories. Attack can be executed remotely, exploit is publicly available.

A security flaw has been discovered in itsourcecode Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=save_user. Performing manipulation of the argument ID results in SQL injection. Remote exploitation of the attack is possible, and the exploit has been released to the public and may be exploited.