The Simple Laundry System 1.0 contains a flaw in the Parameter Handler component, specifically in /checkcheckout.php. By manipulating the serviceId argument, an attacker can inject arbitrary SQL commands. The vulnerability can be triggered remotely, enabling external actors to execute malicious queries against the underlying database, leading to data theft, modification, or deletion.

The affected product is code‑projects Simple Laundry System version 1.0. The flaw exists in the /checkcheckout.php file within the Parameter Handler component. No other versions or variants are indicated as affected.

The CVSS base score of 6.9 reflects moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The vulnerability is not catalogued in CISA’s KEV list. Attackers can exploit the flaw over the network by sending crafted HTTP requests that supply a malicious serviceId parameter, and an exploit has already been made public.