CVE-2026-5033: code-projects Accounting System SQL Injection via cos_id in view_costumer.php
CVE-2026-5033 is a SQL injection flaw in the file /view_costumer.php of code-projects Accounting System 1.0, where the cos_id argument is not handled safely. The record states the attack may be performed remotely and that a public exploit is available, and NVD assigns a base score of 9.8. No fixed version or vendor patch is listed in the sources consulted, so defenders should restrict access and apply input handling fixes.
Overview
A SQL injection flaw (CWE-89) was reported in the file /view_costumer.php of code-projects Accounting System 1.0. According to the record, manipulating the cos_id argument results in SQL injection and the attack may be performed remotely. The CNA is VulDB, and the entry is described at VulDB entry 353959.
Impact
- NVD lists a base score of 9.8 (critical).
- The record lists the technical impact as partial in SSVC data.
- Depending on database permissions and configuration, a SQL injection flaw of this class can expose, alter or delete data. This is an inference from the weakness class, not a confirmed effect in this product.
Affected products and versions
- Code-projects Accounting System, version 1.0.
- Sherlock Accounting System, version 1.0, listed as affected in the record.
- No fixed version is listed in the sources consulted.
Exploitation status
The record states that the exploit is public and may be used, and a public issue tracker entry tagged as exploit is referenced. This CVE is not listed in the CISA KEV catalog, so no active exploitation is confirmed by that source. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00567 with a percentile of 0.46322, and SSVC records exploitation as proof of concept.
Remediation and mitigation
- Identify whether this application is deployed in your environment and whether the page is reachable from untrusted networks.
- No vendor fix is documented in the sources; contact the vendor or maintainer for guidance, or replace the component with a supported product.
- Restrict access to the affected page until a review or fix is completed.
- Apply parameterized queries and strict server-side validation to identifier parameters such as cos_id.
- Run the application with least-privilege database accounts.
Detection guidance
- Review web server logs for requests to view_costumer.php with unusual or non-numeric values in cos_id.
- Monitor application and database logs for SQL errors originating from this page.
- Alert on database activity from the application account that does not match normal behavior.
Limitations of the available information
- The record contains no fixed version, vendor patch status or vendor advisory.
- The exact conditions required for exploitation are not described beyond the record.
- The relationship between the listed Sherlock Accounting System and the code-projects product is not explained in the record.
Frequently asked questions
What is the vulnerability in CVE-2026-5033?
It is a SQL injection flaw in the file /view_costumer.php of code-projects Accounting System 1.0, triggered by manipulating the cos_id argument.
Is there a fix available?
The sources consulted list no fixed version or vendor patch. Restrict access, validate inputs and contact the vendor or maintainer.
Is this vulnerability known to be exploited in the wild?
It is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. The record states a public exploit exists.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.