An unchecked parameter named cos_id in the delete.php file allows an attacker to inject arbitrary SQL statements. The malicious input is inserted directly into a database query without sanitization or parameter binding, putting the system at risk of data theft, modification or deletion. The vulnerability is classified as both a classic SQL injection (CWE-89) and an unsafe construction of database queries (CWE-74).

The issue exists in the code‑projects Accounting System version 1.0. No additional releases or product variants are listed as affected, and the problem is tied specifically to the delete.php endpoint.

The CVSS‑Base score of 5.3 indicates medium severity, reflecting that the flaw does not grant immediate code execution or widespread privilege escalation but does expose critical financial data. An exploit is currently public and can be triggered via an HTTP request from outside the network. No exploit‑probability score is available, and the vulnerability is not listed in the known‑exploited‑vulnerabilities catalog, suggesting limited widespread attention. The attack path requires access to the delete.php resource and the ability to supply a crafted cos_id value; no special credentials are needed.