EUVD-2026-17217
GHSA-4wq3-67r2-ggw9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in code-projects Accounting System 1.0. This issue affects some unknown processing of the file /viewin_costumer.php of the component Parameter Handler. Such manipulation of the argument cos_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
AnalysisAI
Remote SQL injection in code-projects Accounting System 1.0 allows unauthenticated attackers to execute arbitrary SQL queries via the cos_id parameter in the /viewin_costumer.php file. The vulnerability has a CVSS score of 6.9 with a public exploit available, enabling attackers to read sensitive data from the database with minimal attack complexity. This is a network-accessible PHP application flaw affecting confidentiality with confirmed public disclosure.
Technical ContextAI
The vulnerability stems from improper input validation in the Parameter Handler component processing the cos_id argument within /viewin_costumer.php, classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The PHP application fails to properly sanitize or parameterize SQL queries, allowing attackers to inject arbitrary SQL syntax through the cos_id parameter. This is a classic SQL injection attack vector in web applications where user input is concatenated directly into SQL statements without escaping or prepared statement usage. The file /viewin_costumer.php likely retrieves customer information and constructs a SQL WHERE clause using the unsanitized cos_id value, permitting an attacker to break out of the intended query structure.
RemediationAI
The primary remediation is to upgrade code-projects Accounting System to a patched version released after the vulnerability disclosure. Immediate mitigation requires implementing parameterized SQL queries (prepared statements) or using an ORM framework to handle all database interactions, specifically modifying /viewin_costumer.php to use bound parameters for the cos_id argument instead of string concatenation. Input validation must be applied to the cos_id parameter, accepting only expected formats (numeric values for customer IDs). Apply Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the cos_id parameter as a temporary containment measure. Security patches and detailed remediation guidance can be referenced through the VulDB submission at https://vuldb.com/vuln/354183 and the disclosed GitHub issue at https://github.com/Xu-Zhihan/CVE/issues/11. Organizations using this application should prioritize patching given the public exploit availability and zero-authentication attack requirement.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Share
External POC / Exploit Code
Leaving vuln.today