An unauthenticated SQL injection vulnerability in code-projects Accounting System 1.0 allows remote attackers to compromise database integrity and access sensitive information.

The application fails to properly sanitize user input provided to the cos_id parameter in the /view_costumer.php file. This allows an unauthenticated remote attacker to inject malicious SQL commands, facilitating unauthorized database queries or data modification.

Successful exploitation of this SQL injection vulnerability can lead to unauthorized database access, sensitive data leakage, and potential full system compromise. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, which may lead to severe reputational damage and regulatory noncompliance for organizations using this software.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the application to trusted IP ranges and disable the affected functionality if it is not business-critical.

Proactive Monitoring: Monitor web server access logs for anomalous GET requests containing SQL syntax patterns, such as UNION, SELECT, or SLEEP commands, directed at the view_costumer.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns and sanitize incoming traffic to the application.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the security researcher's GitHub write-up.

The presence of a public proof-of-concept combined with the lack of authentication required to execute this attack makes this a high-priority risk. Organizations must treat this vulnerability as critical until the vendor releases an official security update and should prioritize the implementation of WAF rules or network segmentation to mitigate the risk of unauthorized database access.