An unauthenticated SQL injection vulnerability in code-projects Accounting System 1.0 poses a critical risk of unauthorized database access and potential system compromise.

This is a SQL injection vulnerability (CWE-89) located in the /viewin_costumer.php file. An unauthenticated attacker can manipulate the cos_id parameter to inject malicious SQL commands, which are executed by the backend database without proper validation or sanitization.

Successful exploitation allows an attacker to gain unauthorized access to the underlying database, which may lead to sensitive data leakage, modification, or deletion of records. Given the CVSS score of 7.3, this flaw represents a significant risk to data integrity and confidentiality, potentially resulting in service interruption or full system compromise.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the affected /viewin_costumer.php endpoint or disable the vulnerable module entirely.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as unexpected UNION statements, sleep commands, or concatenated strings that indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules configured to block malicious SQL injection payloads targeting the cos_id parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the researcher write-up on GitHub.

Organizations utilizing code-projects Accounting System 1.0 must prioritize the mitigation of this vulnerability, as the lack of authentication makes it trivial for remote attackers to exploit. Until a vendor-supplied patch is released, implementing robust input validation and strict network access controls is essential to prevent unauthorized access to the application database.