This vulnerability in code-projects Accounting System 1.0 involves SQL injection through the en_id parameter in the /view_work.php file's Parameter Handler component. An attacker can remotely manipulate this parameter to execute arbitrary SQL queries. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges required, and no user interaction needed. The vulnerability is publicly disclosed but no confirmed active exploitation is reported. No patch or remediation details have been provided.

Successful exploitation could allow an attacker to execute unauthorized SQL commands on the backend database, potentially leading to data disclosure, modification, or other impacts depending on the database and application context. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or parameterized queries as a temporary mitigation. Monitor vendor channels for updates and apply patches promptly once released.