The vulnerability resides in the file /delmemberinfo.php of the Simple Laundry System component Parameter Handler. An attacker can manipulate the userid argument, which is not properly sanitized, leading to an SQL injection flaw. This flaw would allow the attacker to execute arbitrary SQL statements against the database, potentially exposing, modifying or deleting sensitive information. The weakness is consistent with CWE-74 and CWE-89 standard categories. The severity score of 6.9 indicates a moderate risk of data loss or tampering.

The affected product is code-projects Simple Laundry System version 1.0. Users running this version should verify that the delmemberinfo.php endpoint is protected and update their installation as necessary.

The CVSS score of 6.9 reflects a moderate level of risk, and the vulnerability can be exploited remotely as it can be triggered by sending a crafted request to the exposed endpoint. EPSS information is not available and the vulnerability is not in the KEV catalog, but the publicly disclosed exploit implies that attackers can attempt to exploit it. The likely attack vector is a remote HTTP request that includes a malicious userid parameter to inject SQL commands.