The code-projects Accounting System version 1.0 contains a SQL injection vulnerability in the /view_costumer.php file's Parameter Handler component. Specifically, the cos_id parameter is not properly sanitized, enabling remote attackers to inject SQL commands. This vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), indicating it is exploitable over the network without privileges or user interaction, with low to limited confidentiality, integrity, and availability impacts. The exploit code is publicly available, increasing the risk of exploitation. No vendor advisory or patch information is currently provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database of the affected Accounting System, potentially leading to unauthorized data access or modification. The CVSS score indicates limited but non-negligible impact on confidentiality, integrity, and availability. Since the exploit is public, the risk of exploitation is elevated. However, there is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewall (WAF) rules to block malicious SQL injection attempts targeting the cos_id parameter. Monitor vendor channels for updates and apply patches promptly once released.