Executive brief
A vulnerability exists in the Simple Laundry System, a web application used for managing laundry service operations. An attacker can use this flaw to execute malicious scripts in the browsers of other users, potentially leading to the theft of login sessions or unauthorized actions performed on their behalf. This could compromise the privacy of customers and the integrity of the system's data.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in code-projects Simple Laundry System 1.0 within the /delmemberinfo.php component. The root cause is the failure to properly sanitize or encode the 'userid' GET parameter before reflecting it back into the HTML response. A remote, unauthenticated attacker can exploit this by tricking a user into clicking a specially crafted URL containing a malicious JavaScript payload. Successful exploitation allows for the execution of arbitrary script code in the context of the victim's browser, which can be used to steal session cookies or perform unauthorized actions. A public proof-of-concept (PoC) exists, but no official patch has been confirmed.
Affected products
- code-projects Simple Laundry System 1.0
Timeline
- 2026-03-25: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-04-09: advisory: CVE published.