The Simple Laundry System contains a flaw in the userchecklogin.php module where the userid argument is concatenated directly into SQL statements without adequate sanitization. This weakness is a classic instance of CWE‑89: Improper Neutralization of Special Elements used in an SQL Command, and can be leveraged through the less common CWE‑74 techniques to obfuscate the injected payload. An attacker can supply a crafted userid that causes the database to execute arbitrary SELECT, UPDATE, or DELETE commands, potentially revealing customer data, altering account balances, or deleting records.

Affected product is the code‑projects Simple Laundry System, version 1.0. The vulnerability resides in the userchecklogin.php file handling the userid parameter. No other versions or components are noted as affected in the CVE record.

The CVSS score of 6.9 denotes a medium severity flaw. Because the exploit can be triggered remotely via the userid input, an unauthenticated attacker can obtain or modify sensitive information. No EPSS score is reported, and the issue is not listed in the CISA KEV catalog, indicating that public exploitation may not yet be widespread, but the presence of a publicly disclosed method increases the risk of targeted attacks. Proper database access controls and input validation are therefore essential to mitigate potential impacts.