This vulnerability occurs when the serviceId argument in /checkupdatestatus.php is not properly sanitized, enabling an attacker to inject arbitrary SQL statements. The flaw can lead to disclosure, modification, or deletion of database records, compromising confidentiality and integrity.

The affected application is code-projects Simple Laundry System version 1.0. Other minor versions are unlikely to be affected unless the same unpatched code remains.

With a CVSS score of 6.9, the flaw represents medium severity. The EPSS score is below 1 %, indicating low current exploitation probability, and it is not listed in the CISA KEV catalog. However, because the exploit code is publicly available, attackers can launch a remote attack by sending a crafted serviceId value, prompting the database to execute injected commands and potentially gain full control over the underlying data.