An unauthenticated SQL injection vulnerability in code-projects Accounting System 1.0 allows remote attackers to compromise database integrity and confidentiality.

This is a SQL injection vulnerability (CWE-89) located in the /edit_costumer.php file. The application fails to sanitize the cos_id parameter, allowing an unauthenticated attacker to execute arbitrary SQL commands against the backend database.

Successful exploitation of this flaw allows attackers to bypass authentication, access sensitive information, modify or delete database records, and potentially achieve full system compromise. Given the CVSS score of 7.3, this represents a significant risk to data integrity and business continuity, as it allows unauthorized control over the primary accounting data store.

Immediate Action: As no official vendor patch is available, administrators must restrict access to the /edit_costumer.php endpoint or disable the affected module entirely until a secure version is released.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically looking for SQL syntax characters or error-based payloads targeting the cos_id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, particularly those involving GET requests to the identified vulnerable script.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the researcher's GitHub repository.

This vulnerability presents a high risk due to the ease of exploitation and the potential for total database compromise. Organizations utilizing this software must implement immediate network-level restrictions or WAF-based mitigations to prevent unauthenticated access, as no formal vendor patch is currently available to resolve the underlying code flaw.