CVE-2026-14649: SQL Injection in code-projects Online Voting System 1.0

Technical summary

CVE-2026-14649 is a network-accessible SQL injection flaw in the `test_input` function within `/saveVote.php` of code-projects Online Voting System 1.0. The vulnerability arises from insufficient input validation on four parameters: voterName, voterEmail, voterID, and selectedCandidate. Attackers can craft malformed input to break out of SQL query context and execute arbitrary database commands. The flaw is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-89 (SQL Injection), indicating both the root cause and the downstream impact.

Business impact

A successful exploit could allow attackers to read, modify, or delete voting records and other sensitive database contents. This poses a direct threat to the integrity of elections or polls conducted using this system. Additionally, attackers may extract personally identifiable information stored in the database, leading to privacy breaches and regulatory exposure. The confidentiality, integrity, and availability of the voting platform are all at risk.

Affected systems

The vulnerability specifically affects code-projects Online Voting System version 1.0. Organizations or individuals running this version are immediately vulnerable. The system is accessible remotely via HTTP/HTTPS, meaning any internet-connected instance is exposed to potential exploitation attempts.

Exploitability

This vulnerability has a CVSS v3.1 score of 7.3 (HIGH severity) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The high exploitability is due to the attack being remotely exploitable without authentication (PR:N) or user interaction (UI:N), and with low attack complexity (AC:L). The lack of CISA KEV listing does not diminish the practical exploitability—it reflects the current state of public exploitation tracking rather than the inherent ease of weaponization.

Remediation

Immediate action is required: upgrade to a patched version of code-projects Online Voting System if available from the vendor. If no patch exists, implement strict input validation and parameterized SQL queries in the affected `/saveVote.php` file's `test_input` function for all four vulnerable parameters. Additionally, apply Web Application Firewall (WAF) rules to detect and block SQL injection patterns in voting-related requests, and conduct a forensic review of database logs to determine if the vulnerability has been exploited.

Patch guidance

Check the code-projects or vendor advisory for available patches addressing CVE-2026-14649. Apply patches to all instances of Online Voting System 1.0 in your environment. Verify that input sanitization and parameterized queries are in place for voterName, voterEmail, voterID, and selectedCandidate parameters. If the vendor has not released a patch, prioritize migrating to an alternative, actively maintained voting system solution.

Detection guidance

Monitor `/saveVote.php` access logs for suspicious SQL syntax patterns in POST parameters (e.g., single quotes, UNION keywords, comment sequences). Deploy network-based detection for SQL injection payloads targeting the voting submission endpoint. Use database activity monitoring to identify unusual query patterns or unauthorized data access attempts. Review application logs for errors that may indicate failed SQL injection attempts. Consider deploying a WAF with SQL injection signatures configured specifically for this voting application.

Why prioritize this

Despite not being listed on the CISA KEV catalog, this vulnerability demands immediate prioritization because it affects a critical voting system with no authentication barriers and direct remote access. The HIGH CVSS score reflects multiple impact areas (confidentiality, integrity, availability), and the lack of user interaction requirements means exploitation can occur at scale automatically. Any organization running this system should treat patching or decommissioning as urgent.

Risk score, explained

The CVSS 7.3 (HIGH) score reflects the convergence of high exploitability (network-accessible, no authentication, no user interaction) and moderate-to-broad impact across confidentiality, integrity, and availability. The low attack complexity indicates that standard SQL injection techniques will likely succeed. While the scope is unchanged (impact within the voting system itself), the combination of ease of exploitation and the sensitive nature of the affected system (voting data) justifies the HIGH rating.

Frequently asked questions