This vulnerability arises from improper handling of the firstName argument within the /userfinishregister.php component, allowing an attacker to inject arbitrary SQL statements. The flaw is enumerated as a classical SQL injection violation (CWE‑74) and also raises broader concerns about input validation oversight (CWE‑89). When exploited, an attacker can read, alter, or delete database records, potentially exposing sensitive customer data or disrupting business operations.

The affected product is Code‑Projects Simple Laundry System version 1.0. The flaw resides in the Parameter Handler component of the web application. No other vendor or product versions are listed as impacted.

The CVSS score of 6.9 indicates a moderate‑to‑high severity risk, while the EPSS score is not available and the vulnerability is not listed in KEV. Remote exploitation is explicitly possible, and proof‑of‑concept exploits have been published. Attackers can execute the injection via the firstName field without additional credentials, making the vulnerability readily actionable for remote adversaries.