/delstaffinfo.php includes an unsanitized userid parameter that allows attackers to inject arbitrary SQL statements. The flaw can be exploited remotely, giving an attacker the ability to read, modify, or delete database records, leading to compromise of the system’s confidentiality, integrity, and availability. The vulnerability is identified as a classic SQL injection (CWE‑89) and also reflects improper handling of user input (CWE‑74).

The affected product is code‑projects Simple Laundry System version 1.0, specifically the Parameter Handler component that processes the delstaffinfo.php script. Users running this version without a recent update are potentially susceptible to the described injection flaw.

The stated CVSS score of 6.9 places the vulnerability in the medium severity range. The EPSS figure of less than 1% suggests a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. Attackers would need to send a crafted HTTP request containing a malicious userid value; no authentication is mentioned, so the vulnerability could be triggered from outside the application. Given the public disclosure and the medium impact, organizations should treat this as a moderate risk to their data security.