This vulnerability allows an attacker to perform SQL injection by manipulating the adminUserName or adminPassword arguments processed by the test_input function in the /authentication.php file of the Login component in code-projects Online Voting System version 1.0. The flaw enables remote exploitation without authentication. The CVSS 4.0 base score is 6.9 (medium severity), indicating a network attack vector with low complexity and no privileges or user interaction required. The vulnerability has been publicly disclosed but no known exploits in the wild have been reported. No official fix or mitigation details are currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The impact is limited by the low scope and low confidentiality, integrity, and availability impact metrics, but it still poses a significant risk to the integrity and confidentiality of authentication data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing application-level input validation and parameterized queries as temporary mitigations. Monitor vendor communications for updates on patches or official mitigations.