CVE-2025-6352 is a Medium severity (CVSS 5.3) direct request flaw in code-projects Automated Voting System 1.0, in the backend file /vote.php. A visitor can reach the function without the intended checks. The record lists no fixed version, so add server side access control and check the vendor site for updates.
The weakness is CWE-425, usually called direct request or forced browsing. The Gold page for the CVE is CVE-2025-6352 on Gold.
What's affected
- code-projects Automated Voting System 1.0
- Component: Backend, file /vote.php
- Fixed version: none listed in the record
The description says the manipulation leads to a direct request and that the attack can be launched remotely. The CVSS vector shows network access, low complexity, no privileges and no user interaction, with a limited confidentiality impact only. The record also says the exploit has been disclosed to the public and may be used. A researcher write up titled Unauthorized is among the references.
How to check if you're exposed
First find out whether the application is installed anywhere you run:
find /var/www -type f -name "vote.php" 2>/dev/null
Then test the behaviour on a copy you own. Request the backend page in a browser session that is not logged in and see whether it responds with data or performs its action. If it does, the page relies on the caller arriving by the normal route instead of checking who they are. Only do this on systems you control. Also look in your web server access logs for requests to the file that do not follow a request to the login page, keeping in mind that the record gives no indicators, so this is general review and not confirmed detection.
What to do now
- Put the application behind a VPN or IP allowlist if it does not need to be public.
- Check the code-projects site for a newer release. The record lists no fixed version.
- In the code, add an explicit session and role check at the top of every backend script, including vote.php, and exit before doing any work if it fails.
- Move backend files outside the public web root where the design allows, or deny direct access with web server rules.
- Make sure a vote cannot be recorded without a valid, one time voter session. For any voting tool, review whether duplicate or anonymous submissions are possible.
- Run a dynamic scan against a staging copy to find other pages without checks.
Try it yourself
Click through it at your own pace, or open it full screen.
Why it matters
Direct request flaws are access control failures in plain form. The application assumes users will reach a page through a menu or a button, and never checks again at the page itself. A browser address bar does not follow the menu. Every script that does something sensitive has to ask for itself: who is calling, and are they allowed.
The score is moderate because the vector shows only a limited confidentiality effect, but context changes that. A voting system exists to guarantee that only eligible people take part and that each counts once. If you run this software for anything real, the integrity of results matters more than the number suggests. The record does not mark the CVE as known exploited. Take the sources as researcher reports, not a vendor advisory.
Quick check
What is a direct request flaw?
It is a page or function that can be called straight by its address, skipping the screens that were meant to lead to it, because the page itself does no access check.
Is there a patch for Automated Voting System?
The record lists no fixed version. Check the vendor site and add the access checks in your own copy if you maintain it.
Sources
References listed in the CVE record (not independently fetched for this review):
- https://code-projects.org/
- https://github.com/asd1238525/cve/blob/main/Unauthorized.md
- https://vuldb.com/?ctiid.313344
- https://vuldb.com/?id.313344
- https://vuldb.com/?submit.597239
Last reviewed: 18 October 2026.
