A flaw was discovered in code-projects Accounting System 1.0. The file edit_costumer.php accepts the parameter cos_id without proper validation, which allows an attacker to inject arbitrary SQL. By manipulating this argument, an attacker can retrieve, alter, or delete database records, potentially exposing sensitive customer information or tampering with financial data. The weakness arises from inadequate input handling, consistent with CWE-74 and CWE-89.

The vulnerability affects the code-projects Accounting System, version 1.0, specifically the Parameter Handler component that processes the edit_costumer.php script. No other versions or products are mentioned in the available data.

The CVSS score of 6.9 indicates medium severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is exploitable remotely, and a published exploit demonstrates its feasibility. It is not listed in the CISA KEV catalog, but the existence of publicly available code implies that knowledgeable adversaries could target affected installations.