A weakness in the Simple Laundry System 1.0 allows an attacker to inject arbitrary SQL through manipulation of the searchServiceId parameter in the /searchguest.php file. This flaw is a classic SQL injection that can be triggered remotely and has publicly available exploit code. Successful exploitation would give the attacker the ability to read, modify, or delete data stored in the underlying database, compromising both confidentiality and integrity of the system.

The vulnerability affects the code-projects Simple Laundry System version 1.0. No other versions have been documented in the available data.

The CVSS base score of 6.9 indicates moderate severity, but the attack can be performed over the network and exploits have already been released. With no EPSS data and the vulnerability not listed in the KEV catalog, the risk remains significant. Attackers could easily execute arbitrary SQL statements if the parameter is not properly sanitized or parameterized. The security impact is wide‑ranging and could lead to full data compromise.