A vulnerability exists in the Simple Laundry System that allows an attacker to inject SQL statements through the userid parameter in the modstaffinfo.php component. The flaw can be exploited remotely and may enable the adversary to read, modify, or delete sensitive database records, potentially exposing customer data and compromising the integrity of the system. The weakness is consistent with CWE‑74 (Improper Neutralization of Special Elements used in a Command) and CWE‑89 (SQL Injection).

code-projects Simple Laundry System version 1.0 is affected. No other versions or editions are mentioned in the advisory.

The CVSS score of 6.9 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The publicly released exploit demonstrates that the attack can be performed from remote locations without special privileges, making the risk significant for installations exposed to the internet.