The vulnerability resides in the /checklogin.php processing of the Username field. An attacker can supply a specially crafted string that is incorporated directly into an SQL statement, allowing arbitrary SQL commands to be executed against the underlying database. This could expose sensitive data such as user identifiers, authentication tokens, or even allow modification of database records. The weakness aligns with CWE-74 and CWE-89. The impact is that an attacker can read, modify, or delete data, potentially leading to loss of confidentiality, integrity, or availability of the application data. Note: The vulnerability description was updated, but the new details are not available for analysis.

The affected system is code-projects Simple Laundry System, version 1.0. The vulnerability is tied to the Parameters Handler component in checklogin.php. Any deployment of this version that exposes the login endpoint to users over the network is susceptible. Users running earlier or newer versions where the vulnerability is fixed are not affected.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is remote, requiring the victim to send a malicious Username value to the login script. Successful exploitation does not require local privileges and can be performed over standard HTTP/HTTPS connections. An adversary with no prior access could thus hijack accounts or manipulate system data.