No validation allows unauthorized voting power transfer by any user.

Lines of code Vulnerability details Impact There is no check that the msg.sender is allowed to delegate votes on behalf of the sources. Any user could call delegateMulti and transfer voting power from other addresses. There should be a require statement to ensure msg.sender owns the tokens they a...

people can steal others voting power by creating mlicous proxy contracts

Lines of code Vulnerability details Impact bad actor can control over the other peoples voting power in delegate proxy contracts. lets start from delegateMulti when somebody calls it it leads to delegateMulti and it calls processDelegationsource, target, amount; in the process of loop. if you loo...

CVE-2023-43470

SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via the checklogin.php component...

CVE-2023-43470

SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via the checklogin.php component...

Sql injection

SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via the checklogin.php component...

Online Voting System SQL Injection Vulnerability

Online Voting System is an online voting system by Carlo Montero Personal Developer. A security vulnerability exists in Online Voting System version v.1.0 that could allow a remote attacker to execute arbitrary code via the checklogin.php component...

CVE-2023-43470

SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via the checklogin.php component...

PT-2023-28835 · Unknown · Janobe Online Voting System

Name of the Vulnerable Software and Affected Versions: janobe Online Voting System version 1.0 Description: The issue allows a remote attacker to execute arbitrary code via the checklogin.php component. This is due to a SQL injection vulnerability. Recommendations: For janobe Online Voting System...

CVE-2023-43470

CVE-2023-43470 affects the janobe Online Voting System v1.0, with a SQL injection in checklogin.php that allows a remote attacker to execute arbitrary code. The NVD entry lists a Critical CVSS 3.1 score (9.8) with network access, low attack complexity, and high impacts to confidentiality, integri...

CVE-2023-43470

SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via the checklogin.php component...

DOS in governance when voting after delegate

Lines of code Vulnerability details Impact The GovernorCountingOverridable::handleVoteOverrides function substracts the delegator vote weight from the total votes when the delegatee has already submited a vote. However, if the delegator's vote is greater than the current total vote the substracti...

A malicious delegator could artificially inflate the deductions for a transcoder, potentially leading to incorrect vote counting.

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept In the handleVoteOverrides function, the deductions are added to the transcoder's voter state without any validation: A malicious delegator could call countVote multiple times, each tim...

[M-01] Transcoder can front-run slasher to avoid getting slashed and continue voting

Lines of code Vulnerability details Impact In BondingManager.slashTranscoder, verifier can slash transcoderdelegator bonded amounts. However, this can be easily front runned via BondingManager.unbondWithHint by reducing bonded amount to avoid slashing via underflow and keep bonded position...

Slashed transcoder can gain more voting power than it should if all of his bondedAmount would be slashed

Lines of code Vulnerability details Impact Slashed transcoders can still become active transcorders by bonding an amount again to increase the total stake, which can inflate the actual delegatedAmount, giving those transcorders more power voting power than it should. Proof of Concept Every time...

[M-02] BondingVotes.getPastVotes(): User can easily manipulate voting power for round

Lines of code Vulnerability details Impact User can take a collaterized loan of LPT and bond for a single round to gain voting power for a single round and vote on proposals. This is because when voting, only the single round is checked when retrieving the voting power via...

Fully slashed transcoder can vote with 0 weight messing up the voting calculations

Lines of code Vulnerability details Impact If a transcoder gets slashed fully he can still vote with 0 amount of weight making any other delegated user that wants to change his vote to subtract their weight amount from other delegators/transcoders. Proof of Concept In BondingManager.sol any...

CVE-2023-38916

SQL Injection vulnerability in eVotingSystem-PHP v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the user input fields...

CVE-2023-38916

SQL Injection vulnerability in eVotingSystem-PHP v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the user input fields...

eVotingSystem-PHP SQL Injection Vulnerability

eVotingSystem-PHP is a PHP-based e-voting system by Mohammad Ajazuddin Individual Developer. A security vulnerability exists in eVotingSystem-PHP version v.1.0 that originates from obtaining sensitive information and executing arbitrary code via user input fields...

Any of the role setter , nominee Vetter should not be a council (cohort) member.

Lines of code Vulnerability details Impact The privileged cohort membercouncil member can influence the member addition, removal, rotating the nominee and excluding the nominee. The function of election can be rigged, arbitrary proposals can be passed. This is easy by the council member who has...