Executive brief
A security vulnerability exists in Simple Laundry System, a software application used to manage laundry business operations. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of customer information, tampering with records, or disruption of business services. This attack can be carried out remotely without requiring any login credentials.
Technical details
A SQL injection vulnerability exists in code-projects Simple Laundry System 1.0 within the 'Parameter Handler' component. The root cause is the improper neutralization of special elements in the 'userid' parameter of the /delmemberinfo.php file. A remote, unauthenticated attacker can exploit this by sending specially crafted GET requests to manipulate SQL queries. Successful exploitation allows for unauthorized database access, data exfiltration, and potential full system compromise. Public exploits, including boolean-based blind, error-based, and UNION-based payloads, have been disclosed. No official patch is currently documented; remediation should involve implementing prepared statements and input validation.
Affected products
- code-projects Simple Laundry System 1.0
Timeline
- 2026-03-19: disclosed: Public issue report on GitHub with PoC
- 2026-04-05: advisory: Initial publication of CVE-2026-5565