EUVD-2026-16527
GHSA-gpj8-f2j5-f6j2
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The real-world risk is elevated due to multiple converging factors. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L indicates network-based exploitation with low attack complexity and no authentication required, making this vulnerability highly accessible to opportunistic attackers. The Exploit Maturity score of E:P (Proof-of-concept) combined with publicly available exploit code on GitHub (https://github.com/Niuzzz123/CVE-Niuzzz/issues/2) means attackers have ready-made tools for exploitation. However, the Limited impact ratings (C:L/I:L/A:L) suggest the vulnerability may have constraints on the depth of database access achievable. The application targets small business environments where security monitoring may be minimal, and the PHP/web-based attack surface is easily scanned and fingerprinted. Organizations running Simple Laundry System 1.0 should treat this as a high-priority remediation given the combination of no authentication requirement, public exploit availability, and the sensitive nature of customer data typically stored in laundry management systems. |
| Exploit ScenarioDerived | An unauthenticated remote attacker scans for Simple Laundry System installations by fingerprinting the /modstaffinfo.php endpoint. Using the publicly available GitHub exploit code, the attacker crafts malicious SQL payloads in the userid parameter to enumerate database tables, extract customer records including names and contact information, or modify pricing data to cause business disruption. Given the low attack complexity (AC:L) and network accessibility (AV:N), automated scanning tools can identify and exploit vulnerable instances at scale without requiring specialized expertise or privileged access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 27, 2026
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the userid parameter in /modstaffinfo.php. Publicly available exploit code exists on GitHub, significantly lowering the barrier to exploitation. The CVSS score of 7.3 reflects network accessibility without authentication requirements (PR:N), though impact is rated as Low across confidentiality, integrity, and availability.
RemediationAI
No vendor-released patch identified at time of analysis. Organizations running Simple Laundry System 1.0 should immediately implement input validation and parameterized queries for the userid parameter in /modstaffinfo.php through custom code modification. Apply prepared statements or PDO parameterized queries in the PHP codebase to prevent SQL injection. As an interim mitigation, implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting /modstaffinfo.php, specifically monitoring for SQL metacharacters in the userid parameter. Restrict network access to the application to trusted IP ranges and deploy behind authentication proxy layers. Consider replacing this software with actively maintained alternatives given the apparent lack of vendor security response, as evidenced by the absence of official security advisories at the vendor website (https://code-projects.org/) or in the VulDB references. Monitor VulDB entries https://vuldb.com/?id.353659 and https://vuldb.com/?ctiid.353659 for any vendor response or community patches.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects code-projects Simple Laundry System version 1.0, a PHP-based web application for laundry business management (CPE: cpe:2.3:a:code-projects:simple_laundry_system:*:*:*:*:*:*:*:*). The flaw is classified as CWE-89 (SQL Injection), indicating improper neutralization of special elements used in SQL commands within the Parameter Handler component. Specifically, the /modstaffinfo.php endpoint fails to properly sanitize the userid parameter before incorporating it into database queries, allowing attackers to inject arbitrary SQL commands that will be executed by the backend database server. This is a classic first-order SQL injection where user-controlled input directly influences SQL query construction without adequate input validation or parameterized query implementation.
Know when Simple Laundry System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /modstaffinfo.php of the component Parameter Handler. The manipulation of the argument userid results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Executive ViewAI
Simple Laundry System 1.0 contains an unauthenticated SQL injection vulnerability that allows attackers to directly access and manipulate the underlying database without valid credentials. Organizations running this application face immediate risk of unauthorized data extraction, modification, or destruction, with publicly available exploit code substantially lowering the technical barrier to attack.
Implement Web Application Firewall (WAF) rules to block SQL injection payloads in the userid parameter; restrict network access to /modstaffinfo.php to internal/administrative IP ranges only; enable database activity monitoring and alerting on unauthorized queries; segment the application database from other critical systems; conduct daily database integrity checks and maintain offline backups. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in code-projects Web Application SQL and XSS
View all 2More in Simple Laundry System
View allSQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQ
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or
SQL injection in Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via
SQL injection in Simple Laundry System 1.0's /checkregisitem.php parameter handler allows unauthenticated remote attacke
SQL injection in Simple Laundry System 1.0 PHP application allows unauthenticated remote attackers to execute arbitrary
SQL injection in Simple Laundry System 1.0's /checklogin.php parameter handler allows unauthenticated remote attackers t
SQL injection in Simple Laundry System 1.0's /checkupdatestatus.php parameter handler allows unauthenticated remote atta
SQL injection in Simple Laundry System 1.0 through the serviceId parameter in /viewdetail.php allows unauthenticated rem
Cross-site request forgery in code-projects Laundry System 1.0 allows an attacker to perform unauthorized actions on beh
Cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject arbitrary script
Reflected cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers
Cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject malicious script
Exploit-DB