CVE-2026-5034 is a SQL injection flaw (CWE-89) in code-projects Accounting System 1.0, in /edit_costumer.php, through the cos_id parameter. NVD scores it 7.3 high and says a public exploit exists. No fixed version is named, so remove public access and patch the query yourself.
What's affected
code-projects Accounting System version 1.0, per the CVE record. The weak spot is the /edit_costumer.php file, handled by the component the record calls Parameter Handler, and the cos_id argument is the input that reaches the database.
The record lists no patched release. Treat every copy of version 1.0 as affected until you have changed the code.
How to check if you're exposed
This is a downloadable PHP sample project, so there is no package manager entry to query. Look in your web root instead.
grep -rn "cos_id" --include=*.php /var/www/
Open /edit_costumer.php and read how cos_id is used. If the value is placed into a SQL string by concatenation, the code is exposed. Accounting software tends to hold customer names and financial rows, so test copies often carry real data.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Find every deployment of Accounting System 1.0, including test and demo copies that were put online and forgotten.
- Take public instances offline or restrict them to a VPN or an allowlist of addresses until the code is fixed.
- Rewrite the query that uses
cos_idas a prepared statement with bound parameters, using PDO or mysqli, and cast numeric ids to integers before use. - Search web server and database logs for unusual values in this parameter and for SQL errors returned to clients.
- Give the database account used by the app only the rights it needs.
Why it matters
SQL injection (CWE-89, a child of the injection family CWE-74) happens when user input becomes part of a query instead of data passed to it. The write-up for this CVE states the cause plainly: the cos_id value is used directly in a SQL query without cleaning or validation.
In an accounting tool the tables behind that query usually hold customer and transaction records, which is why even a 7.3 score deserves attention. The record does not flag this CVE as a CISA Known Exploited Vulnerability, but it does say the exploit has been published.
Quick check
Is there a patch for Accounting System 1.0?
None is named in the record or in the issue that reports it. Check the vendor site and the advisory for updates, and fix the query in your own copy if you must keep running it.
Does a web application firewall solve this?
It can block common attack strings and buy time, but it does not fix the query. The durable fix is a parameterized statement in the code.
Sources
Last reviewed: 19 October 2026.
