Executive brief
Simple Laundry System, a web application for managing laundry services, contains a security flaw that allows attackers to inject malicious scripts into the application. By tricking a user into clicking a specially crafted link, an attacker could execute code in the user's browser to steal session information or perform unauthorized actions. This vulnerability can be exploited remotely without needing an account on the system.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in code-projects Simple Laundry System 1.0 within the /checkcheckout.php file. The application fails to properly validate or encode the 'serviceId' GET parameter before rendering it back to the user in the web page. A remote, unauthenticated attacker can exploit this by sending a crafted URL containing a malicious script payload to a victim. If the victim visits the link, the script executes in their browser context, potentially allowing for session cookie theft or unauthorized state-changing operations. A public proof-of-concept (PoC) using a script tag with a prompt function has been disclosed.
Affected products
- code-projects Simple Laundry System 1.0
Timeline
- 2026-04-02: disclosed: Initial disclosure on GitHub issues
- 2026-04-10: advisory: NVD publication date