The vulnerability resides in the file /viewin_costumer.php of the Parameter Handler in code-projects Accounting System 1.0. By manipulating the cos_id argument, an attacker can inject arbitrary SQL statements, potentially leading to unauthorized data disclosure, modification or deletion. The attack is carried out by sending crafted HTTP requests to the web server, making the weakness exploitable from a remote location. The weaknesses correspond to CWE‑74 (Improper Filtering or Sanitization) and CWE‑89 (Improper Neutralization of Special Elements used in an SQL Command).

code-projects Accounting System version 1.0 is affected.

The CVSS score of 6.9 indicates a medium severity, suggesting significant impact if exploited. No EPSS score is available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the public disclosure of the exploit implies that it can be used by attackers. The exploit requires a remote web request targeting the cos_id parameter, and no additional preconditions are listed in the description.