Executive brief
Simple Laundry System, a web application used for managing laundry service operations, contains a security flaw in its guest search feature. An attacker can exploit this to access the underlying database without needing a username or password. This could lead to the theft of customer information, unauthorized modification of records, or a complete shutdown of the management system.
Technical details
A SQL injection vulnerability exists in code-projects Simple Laundry System 1.0 within the 'Parameter Handler' component of /searchguest.php. The root cause is the improper neutralization of the 'searchServiceId' POST parameter before it is used in a database query. A remote, unauthenticated attacker can supply crafted SQL payloads (including boolean-based blind, error-based, time-based blind, and UNION-based techniques) to manipulate queries. Successful exploitation allows for unauthorized database access, data exfiltration, and potential system compromise. A public proof-of-concept (PoC) using sqlmap has been disclosed.
Affected products
- code-projects Simple Laundry System 1.0
Timeline
- 2026-03-19: disclosed: Initial discovery and PoC shared on GitHub
- 2026-04-05: advisory: CVE-2026-5564 published