This vulnerability allows attackers to inject arbitrary SQL statements into the cos_id parameter of the view_costumer.php page, leading to unauthorized data exposure or modification. The flaw resides in the Parameter Handler component, and because the input is not properly sanitized, an attacker can manipulate the database query. This could result in compromising customer information, altering financial records, or potentially escalating privileges within the application.

The affected system is the code‑projects Accounting System version 1.0. This product runs on the hosting platform where the vulnerable code is deployed.

The CVSS score of 6.9 indicates moderate to high severity. The EPSS score is below 1%, suggesting low current exploitation probability, and the issue is not listed in the CISA KEV catalog. However, the public exploit shows that remote attackers can trigger the injection by sending a crafted request to the cos_id argument. Because the attack vector is remote and requires only HTTP access, the vulnerability is potentially reachable by external adversaries.