CVE-2026-4836

Vulnerability

Overview

The Code-Projects Accounting System version 1.0 contains a time-based blind SQL injection vulnerability in the /my_account/delete.php endpoint. The application fails to properly sanitize the cos_id parameter before incorporating it into an SQL query, and does not use prepared statements [1]. This input validation flaw allows an attacker to inject arbitrary SQL commands through the cos_id field [1].

Exploitation

Method

The vulnerability is exploitable remotely without authentication. An attacker can craft special SQL payloads within the cos_id parameter and use database delay functions such as SLEEP() to induce measurable server response delays [1]. Since the application does not display database error messages, the attack relies on time-based blind SQL injection techniques, enabling the attacker to infer database information based on response timing differences [1].

Impact

Successful exploitation could allow an attacker to enumerate database structures and extract sensitive information, such as user credentials, administrative data, or other records stored in the database [1]. The extent of unauthorized access depends on the privileges of the database account used by the application [1].

Mitigation

Status

As of the publication date (2026-03-26), public exploit code has been released, increasing the risk of active exploitation [1]. The vendor Code-Projects has not yet provided an official patch. The recommended mitigation is to implement input validation, use parameterized queries (prepared statements) for all database interactions, and restrict database account privileges [1].