Executive brief
Simple Laundry System, a web application for managing laundry services, contains a security flaw that allows attackers to run malicious scripts in a user's browser. By tricking a user into clicking a specially crafted link, an attacker could steal login session information or perform unauthorized actions on the user's behalf. This could lead to unauthorized access to the system or the theft of sensitive customer data.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in code-projects Simple Laundry System 1.0 within the /checkupdatestatus.php endpoint. The root cause is the failure to properly sanitize or encode the 'serviceId' GET parameter before reflecting it back into the HTML response. A remote, unauthenticated attacker can exploit this by crafting a malicious URL containing a script payload and inducing a victim to visit it. Successful exploitation allows for the execution of arbitrary JavaScript in the context of the victim's browser session, which can be used to steal session cookies or perform actions as the authenticated user. A public exploit (PoC) has been disclosed.
Affected products
- code-projects Simple Laundry System 1.0
Timeline
- 2026-04-03: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-04-13: advisory: CVE-2026-6150 published.