A flaw in the 1.0 release of Simple Laundry System, located in the modifymember.php file, permits attackers to manipulate the firstName parameter so that it is directly embedded into a SQL statement without proper validation. This omission enables a classic SQL injection attack that can lead to unauthorized data exposure, modification, or deletion. The vulnerability is publicly disclosed and can be triggered from outside the network, making it accessible to remote actors.

The only documented affected version is the 1.0 release of code‑projects Simple Laundry System. No other version ranges are listed or implied. The weakness resides within the Parameter Handler component handling input for member modification.

The CVSS base score of 6.9 indicates a medium severity vulnerability. Because the attack vector is remote and requires only a crafted firstName field, the opportunity for exploitation is high on systems where this endpoint is exposed without strict access controls. The EPSS score is unavailable, and the vulnerability has not been listed in CISA’s KEV catalog, but the widely known public disclosure and remote nature suggest that remediation should be prioritized.