CVE-2025-10078
📋 TL;DR
This SQL injection vulnerability in SourceCodester Online Polling System 1.0 allows attackers to manipulate database queries through the ID parameter in /admin/candidates.php. Remote attackers can potentially read, modify, or delete database contents, including sensitive polling data and administrative credentials. All deployments of version 1.0 are affected.
💻 Affected Systems
- SourceCodester Online Polling System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, administrative account takeover, and potential server compromise via SQL injection to RCE chaining.
Likely Case
Unauthorized access to polling data, voter information, and potential administrative credential extraction.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing without modification.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries as workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to ensure ID parameter contains only numeric values
Modify /admin/candidates.php to include: if(!is_numeric($_GET['ID'])) { die('Invalid input'); }
Web Application Firewall Rule
allBlock SQL injection patterns targeting the candidates.php endpoint
WAF rule: Block requests to /admin/candidates.php containing SQL keywords like UNION, SELECT, INSERT, UPDATE, DELETE in parameters
🧯 If You Can't Patch
- Restrict access to /admin/ directory to trusted IP addresses only
- Disable the polling system entirely if not in critical use
🔍 How to Verify
Check if Vulnerable:
Test /admin/candidates.php?ID=1' OR '1'='1 and observe if SQL error or unexpected behavior occursCheck Version:
Check source code or documentation for version 1.0 referenceVerify Fix Applied:
Test with same payload after implementing fixes - should return error message or no data📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts to admin interface
- Unusual database queries from web server process
- Access to /admin/candidates.php with suspicious ID parameters
Network Indicators:
- HTTP requests to /admin/candidates.php containing SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_access.log" AND uri="/admin/candidates.php" AND (param="*UNION*" OR param="*SELECT*" OR param="*INSERT*")