CVE Intelligence
Analysis AI-assisted

CVE-2026-5034: code-projects Accounting System SQL injection in edit_costumer.php

CVE-2026-5034 is an SQL injection flaw in the cos_id argument of /edit_costumer.php in code-projects Accounting System 1.0, reported by VulDB with a critical CVSS 3.1 base score of 9.8 from NVD. The record states the attack can be started remotely and that a published exploit may be used. No fixed version is listed in the record, and CISA KEV does not list this CVE.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-5034 concerns an SQL injection weakness (CWE-89) in the cos_id argument handled by /edit_costumer.php, part of the Parameter Handler component of code-projects Accounting System 1.0. The CNA is VulDB, and the record was published on 2026-03-29. The record lists Sherlock Accounting System version 1.0 as a second affected product.

Impact

  • The NVD base score is 9.8 (critical), with high confidentiality, integrity and availability impact in the vector.
  • VulDB also published lower scores in other CVSS versions, so the severity depends on which scoring source is used.
  • SQL injection can, in general, allow reading or changing database content. The exact effect here is not described in the record.

Affected products and versions

  • Code-projects Accounting System, version 1.0.
  • Sherlock Accounting System, version 1.0, as listed in the record.
  • No other versions are identified in the sources consulted.

Exploitation status

  • The record states that an exploit has been published and may be used, and a GitHub issue is tagged as an exploit reference.
  • The CVE is not listed in CISA KEV in the record.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • SSVC data in the record marks exploitation as proof of concept and automatable as yes.

Remediation and mitigation

  • The record lists no fixed version and no vendor patch. Check the vendor site and the VulDB entry for updates.
  • Restrict access to the affected application to trusted networks until a fix or an adequate mitigation is confirmed.
  • Where the code can be changed, use parameterized queries and strict server-side validation of identifiers such as cos_id.
  • If the application cannot be fixed, consider removing it from internet-facing use or isolating it.

Detection guidance

  • Review web server and application logs for unusual or malformed values in requests to /edit_costumer.php.
  • Watch for database error messages or abnormal response sizes on that endpoint.
  • Check database accounts used by the application for unnecessary privileges.

Limitations of the available information

  • The record does not identify the vendor patch status or any fixed version.
  • The exact exploitation steps and the data that could be affected are not described.
  • The EPSS value in the record (0.00545) is a probability estimate and does not confirm active attacks.
  • The record's EPSS date is not consistent with the publication date and should be verified.

Frequently asked questions

What is CVE-2026-5034?

It is an SQL injection flaw in the cos_id argument of /edit_costumer.php in code-projects Accounting System 1.0, as described in the record.

Is there a fix available?

The record lists no fixed version. Check the vendor and VulDB entry for updates and apply compensating controls meanwhile.

Is this vulnerability being actively exploited?

CISA KEV does not list it in the record, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a published exploit exists.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.