This vulnerability affects code-projects Accounting System 1.0 and involves improper sanitization of the cos_id parameter in the /edit_costumer.php file's Parameter Handler component. An attacker can remotely manipulate this parameter to inject SQL commands, potentially compromising the database. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. No patch or vendor advisory is provided, and exploit code is publicly available.

Successful exploitation allows remote attackers to perform SQL injection attacks against the affected system, which could lead to unauthorized access or modification of database contents. The impact is rated medium severity with limited impact on confidentiality, integrity, and availability according to the CVSS vector. No confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries to mitigate SQL injection risks in the affected component. Monitor for updates from the vendor regarding patches or official mitigations.