The vulnerability CVE-2026-5150 affects code-projects Accounting System 1.0 due to insufficient sanitization of the cos_id argument in the /viewin_costumer.php script of the Parameter Handler component. This improper input validation enables remote attackers to perform SQL injection attacks by injecting malicious SQL code through the cos_id parameter. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks an official patch or vendor advisory detailing remediation.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access, data modification, or other database-related impacts depending on the database privileges of the application. However, the impact is rated medium due to limited scope and low to limited impact on confidentiality, integrity, and availability as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewall rules to block malicious SQL injection attempts targeting the cos_id parameter in /viewin_costumer.php. Monitor vendor channels for updates and patches.