Executive brief
The Simple Laundry System, a web application for managing laundry service operations, contains a security flaw in its login processing component. An attacker can exploit this to bypass authentication, access the underlying database, and steal or modify sensitive customer and business information. This could lead to a total loss of data confidentiality and unauthorized control over the laundry management system.
Technical details
A SQL injection vulnerability exists in code-projects Simple Laundry System 1.0 within the /userchecklogin.php file. The root cause is the improper neutralization of the 'userid' POST parameter before it is used in a SQL query. An unauthenticated remote attacker can provide specially crafted input (such as time-based blind payloads) to manipulate database queries. This can result in unauthorized access to sensitive data, data tampering, or full administrative bypass. A public exploit (PoC) has been disclosed, and the vulnerability can be exploited without any prior authentication or user interaction.
Affected products
- code-projects Simple Laundry System 1.0
Timeline
- 2026-03-25: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-04-09: advisory: NVD publication date