CVE-2026-5035: Sherlock Accounting System SQLi Vulnerability

CVE-2026-5035 Overview

A SQL Injection vulnerability has been identified in code-projects Accounting System version 1.0. This security flaw affects the /view_work.php file within the Parameter Handler component. Attackers can exploit this vulnerability by manipulating the en_id parameter to inject malicious SQL commands, potentially compromising the underlying database. The vulnerability is remotely exploitable and exploit details have been publicly disclosed.

Critical Impact

Remote attackers can execute arbitrary SQL commands through the en_id parameter in /view_work.php, potentially leading to unauthorized data access, modification, or deletion of database records in the accounting system.

Affected Products

• Sherlock Accounting System 1.0
• code-projects Accounting System 1.0

Discovery Timeline

• 2026-03-29 - CVE CVE-2026-5035 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-5035

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) exists in the /view_work.php file of the Sherlock Accounting System. The vulnerability stems from improper neutralization of special elements used in SQL commands, allowing attackers to inject malicious SQL syntax through user-controlled input. The broader CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) classification indicates that user input is being passed directly to database queries without adequate sanitization or parameterization.

The network-accessible nature of this vulnerability means that attackers can exploit it remotely without requiring authentication or user interaction. Successful exploitation could result in unauthorized read and write access to sensitive financial data stored in the accounting system's database, including potentially sensitive business records, user credentials, and transaction histories.

Root Cause

The root cause of this vulnerability is improper input validation and sanitization of the en_id parameter in the /view_work.php file. The application fails to properly validate, sanitize, or parameterize user-supplied input before incorporating it into SQL queries. This allows attackers to inject arbitrary SQL syntax that gets executed by the database engine with the same privileges as the application's database connection.

Attack Vector

The attack is executed remotely over the network by sending specially crafted HTTP requests to the /view_work.php endpoint. The attacker manipulates the en_id parameter to include SQL injection payloads. Since no authentication or user interaction is required, an attacker simply needs network access to the vulnerable web application to execute the attack.

The vulnerability allows for classic SQL injection techniques including:

• Union-based injection to extract data from other tables
• Boolean-based blind injection to enumerate database contents
• Time-based blind injection when other methods are not viable
• Potential for stacked queries depending on database configuration

For technical details and proof-of-concept information, refer to the GitHub CVE Issue #8 and the VulDB Vulnerability #353961 entry.

Detection Methods for CVE-2026-5035

Indicators of Compromise

• Unusual SQL error messages appearing in application logs or returned to users
• Unexpected queries in database logs containing UNION SELECT, OR 1=1, or other SQL injection signatures
• Anomalous access patterns to /view_work.php with suspicious en_id parameter values
• Database audit logs showing unauthorized data access or modification attempts

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in the en_id parameter
• Monitor HTTP request logs for suspicious characters in query parameters (single quotes, semicolons, SQL keywords)
• Enable database query logging and alert on queries containing injection signatures
• Deploy intrusion detection systems with SQL injection detection signatures

Monitoring Recommendations

• Enable detailed logging for all requests to /view_work.php and the Parameter Handler component
• Configure real-time alerting for SQL syntax errors generated by the accounting application
• Monitor database connection activity for unusual query patterns or excessive data extraction
• Review access logs for repeated requests with varying en_id parameter values indicating automated scanning

How to Mitigate CVE-2026-5035

Immediate Actions Required

• Restrict network access to the accounting system to trusted IP addresses only
• Implement a Web Application Firewall (WAF) with SQL injection protection rules
• Disable the /view_work.php functionality if not critical to business operations
• Review and audit all database accounts used by the application for least privilege access

Patch Information

At the time of publication, no official vendor patch has been released for this vulnerability. Users should monitor the Code Projects Security Portal for security updates. It is recommended to implement the workarounds listed below until an official patch becomes available.

For additional vulnerability intelligence, consult the VulDB CTI for #353961.

Workarounds

• Apply input validation and sanitization to the en_id parameter, accepting only numeric values
• Implement parameterized queries (prepared statements) for all database interactions involving user input
• Deploy a reverse proxy or WAF to filter malicious SQL injection attempts before they reach the application
• Consider disabling the vulnerable component until a permanent fix is available

# WAF Rule Example - Block SQL Injection Patterns
# Add to your web application firewall or mod_security configuration
SecRule ARGS:en_id "@detectSQLi" "id:1001,phase:2,deny,status:403,msg:'SQL Injection Attempt Detected in en_id'"

# Apache mod_rewrite - Restrict en_id to numeric values only
RewriteCond %{QUERY_STRING} en_id=[^0-9] [NC]
RewriteRule .* - [F,L]