Which versions of PHP are affected by CVE-2026-4908?

Simple Laundry System 1.0 contains an unauthenticated SQL injection vulnerability that allows attackers to directly access and manipulate the underlying database without valid credentials.

Is there a public PoC exploit available for CVE-2026-4908?

Yes, a public proof-of-concept exploit is available for CVE-2026-4908. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4908?

Within 24 hours: Immediately audit all internet-facing instances of Simple Laundry System 1.0 and document their locations and data sensitivity. Implement WAF rules blocking SQL metacharacters in the userid parameter of /modstaffinfo.php. Within 7 days: If the application is business-critical, isolate it to internal network access only or restrict /modstaffinfo.php to authenticated administrative networks via firewall rules. Within 30 days: Evaluate replacement solutions or migration roadmap, as no vendor patch is available and the application version is unsupported. Contact the vendor (code-projects) for security update availability and timeline.

PHP CVE-2026-4908

Q: What is the CVSS score of CVE-2026-4908?

CVE-2026-4908 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16527 MEDIUM

SQL Injection (CWE-89)

2026-03-27 VulDB

GHSA-gpj8-f2j5-f6j2

PHP SQLi Simple Laundry System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 03, 2026 - 17:51 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 02:45 euvd

EUVD-2026-16527

Analysis Generated

Mar 27, 2026 - 02:45 vuln.today

CVE Published

Mar 27, 2026 - 02:25 nvd

MEDIUM 6.9

DescriptionCVE.org

A security flaw has been discovered in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /modstaffinfo.php of the component Parameter Handler. The manipulation of the argument userid results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the userid parameter in /modstaffinfo.php. Publicly available exploit code exists on GitHub, significantly lowering the barrier to exploitation. The CVSS score of 7.3 reflects network accessibility without authentication requirements (PR:N), though impact is rated as Low across confidentiality, integrity, and availability.

Technical ContextAI

This vulnerability affects code-projects Simple Laundry System version 1.0, a PHP-based web application for laundry business management (CPE: cpe:2.3:a:code-projects:simple_laundry_system:*:*:*:*:*:*:*:*). The flaw is classified as CWE-89 (SQL Injection), indicating improper neutralization of special elements used in SQL commands within the Parameter Handler component. Specifically, the /modstaffinfo.php endpoint fails to properly sanitize the userid parameter before incorporating it into database queries, allowing attackers to inject arbitrary SQL commands that will be executed by the backend database server. This is a classic first-order SQL injection where user-controlled input directly influences SQL query construction without adequate input validation or parameterized query implementation.

RemediationAI

No vendor-released patch identified at time of analysis. Organizations running Simple Laundry System 1.0 should immediately implement input validation and parameterized queries for the userid parameter in /modstaffinfo.php through custom code modification. Apply prepared statements or PDO parameterized queries in the PHP codebase to prevent SQL injection. As an interim mitigation, implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting /modstaffinfo.php, specifically monitoring for SQL metacharacters in the userid parameter. Restrict network access to the application to trusted IP ranges and deploy behind authentication proxy layers. Consider replacing this software with actively maintained alternatives given the apparent lack of vendor security response, as evidenced by the absence of official security advisories at the vendor website (https://code-projects.org/) or in the VulDB references. Monitor VulDB entries https://vuldb.com/?id.353659 and https://vuldb.com/?ctiid.353659 for any vendor response or community patches.