Which versions of PHP are affected by CVE-2026-5033?

Code-Projects Accounting System 1.0 contains an unauthenticated SQL injection vulnerability in the customer view function that allows attackers to extract, modify, or delete database records without…

Is there a public PoC exploit available for CVE-2026-5033?

Yes, a public proof-of-concept exploit is available for CVE-2026-5033. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5033?

Within 24 hours: Identify all instances of Code-Projects Accounting System 1.0 in production and development environments; isolate affected systems from untrusted networks and restrict access to authorized personnel only. Within 7 days: Contact the vendor for patch timeline or alternative secure version; implement input validation and prepared statements as interim code-level mitigations if the vendor does not release a patch. Within 30 days: Migrate to a patched version if released, or evaluate replacement with a maintained accounting system; conduct full database audit for unauthorized access or modifications.

PHP CVE-2026-5033

Q: What is the CVSS score of CVE-2026-5033?

CVE-2026-5033 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16975 MEDIUM

SQL Injection (CWE-89)

2026-03-29 VulDB

PHP SQLi Accounting System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Mar 30, 2026 - 18:59 vuln.today

Public exploit code

EUVD ID Assigned

Mar 29, 2026 - 05:45 euvd

EUVD-2026-16975

Analysis Generated

Mar 29, 2026 - 05:45 vuln.today

CVE Published

Mar 29, 2026 - 05:15 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was detected in code-projects Accounting System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_costumer.php of the component Parameter Handler. The manipulation of the argument cos_id results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.

AnalysisAI

SQL injection in code-projects Accounting System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the cos_id parameter in /view_costumer.php. Publicly available exploit code exists (GitHub POC published), enabling trivial exploitation with no authentication required. CVSS 7.3 reflects high exploitability (AV:N/AC:L/PR:N) with partial impact across confidentiality, integrity, and availability. No vendor-released patch identified at time of analysis.

Technical ContextAI

This vulnerability affects code-projects Accounting System version 1.0, a PHP-based web application for managing accounting operations (CPE: cpe:2.3:a:code-projects:accounting_system:*:*:*:*:*:*:*:*). The flaw is a classic SQL injection (CWE-89) in the Parameter Handler component of /view_costumer.php, where the cos_id GET/POST parameter is not properly sanitized before being incorporated into SQL queries. SQL injection allows attackers to break out of intended query logic by injecting malicious SQL syntax, enabling direct interaction with the backend database. In PHP applications without prepared statements or input validation, untrusted user input passed directly to database queries creates this vulnerability class. The exploit targets customer view functionality, suggesting the vulnerable query retrieves customer records based on the supplied ID.

RemediationAI

No vendor-released patch identified at time of analysis for code-projects Accounting System 1.0. Immediate mitigation requires implementing application-layer controls: deploy a web application firewall (WAF) with SQL injection signature detection to filter malicious requests to /view_costumer.php, specifically blocking SQL metacharacters in the cos_id parameter. For organizations with access to source code, apply input validation by implementing prepared statements with parameterized queries in the affected PHP file, or use frameworks like PDO with bound parameters to prevent SQL injection. Alternative mitigation includes restricting network access to the application to trusted IP ranges only, or decommissioning the software in favor of actively maintained alternatives. Refer to VulDB advisory https://vuldb.com/vuln/353959 and GitHub POC https://github.com/Xu-Zhihan/CVE/issues/6 for technical details. Given the apparent lack of vendor support and active maintenance, organizations should prioritize migration to a supported accounting system with an active security update process.