A critical SQL injection vulnerability in code-projects Accounting System 1.0 allows unauthenticated attackers to compromise database integrity and potentially gain full system control.

The application fails to properly sanitize the en_id parameter within the /view_work.php file, which is directly processed in SQL queries. This flaw permits unauthenticated users to perform SQL injection attacks to bypass security controls and access sensitive information.

Successful exploitation of this vulnerability can lead to unauthorized access to the underlying database, resulting in the theft of sensitive financial or personal data. Furthermore, an attacker may be able to modify or delete critical records, leading to severe data integrity loss, operational downtime, and potential regulatory non-compliance. With a CVSS score of 7.3, this vulnerability represents a high-risk entry point that could be leveraged for comprehensive system compromise.

Immediate Action: As no official patch is currently available, administrators should restrict access to the Accounting System or disable the vulnerable /view_work.php file until the vendor releases a security update.

Proactive Monitoring: Security teams should review web server access logs for anomalous GET requests containing SQL syntax, such as UNION, SELECT, or SLEEP commands, targeting the en_id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the Accounting System application.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub research write-up referenced in the CVE record.

Given the availability of public proof-of-concept code and the lack of a vendor-provided patch, this vulnerability poses a significant risk to any organization running Accounting System 1.0. Organizations must prioritize immediate isolation of the affected instance or the implementation of strict WAF filtering to prevent unauthorized database access. Continuous monitoring for indicators of compromise is essential until a formal update is released and applied.