A flaw exists in the Accounting System’s view_work.php file that allows an attacker to supply a crafted value for the en_id parameter. The manipulation of this input enables a classic SQL injection, which can lead to unauthorized data exposure, data modification, or account compromise. The weakness is rooted in improper handling of user-supplied data, matching the CWE-74 and CWE-89 classes of web application vulnerabilities. The impact is limited to the data accessed through the vulnerable endpoint but can be significant if sensitive accounting records are retrievable or tampered with.

The vulnerability affects the code‑projects Accounting System, specifically any installation of version 1.0 as identified by the component Parameter Handler in view_work.php. No other versions are confirmed to be impacted based on the provided information.

The CVSS score of 6.9 places the flaw in the medium to high severity range, while the EPSS score of less than 1% indicates a low probability of exploitation under current conditions. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known public exploitation campaigns. Attackers can exploit the flaw remotely through a web request that targets the en_id argument, potentially gaining database access if proper defensive controls are absent. The risk is primarily contingent on the application’s exposure to untrusted input and the security posture of the underlying database.