A flaw in the Parameters Handler component of the Simple Laundry System allows an attacker to alter the serviceId request parameter in viewdetail.php, leading to a classic SQL injection vulnerability. By injecting malicious SQL, an adversary can read, modify or delete rows in the underlying database, potentially exposing customer data, tampering with business logic, or disrupting service availability. The weakness is identified as CWE-89 and CWE-74, reflecting improper input handling and unsafe embedding of user data in SQL statements.

The vulnerability exists in code-projects Simple Laundry System version 1.0. Administrators of installations running this product should verify if the Parameters Handler or the viewdetail.php component remains unchanged. No older or newer versions are explicitly referenced in this advisory, so any deployments of the 1.0 build are considered affected.

The CVSS base score of 6.9 indicates a moderate risk level. Exploitation is feasible over the network, requiring only the ability to send a crafted HTTP request to the Parameters Handler. The EPSS score is below 1%, suggesting that publicly available exploit code is unlikely to be actively used at this time. The vulnerability is not listed in CISA’s KEV catalog. Nevertheless, because the flaw permits remote code manipulation of database queries, any attacker who can reach the web interface can achieve persistence and data compromise.