PHP
CVE-2026-5824
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Impact | CVSS 6.9 indicates moderate risk with network-based attack vector (AV:N), low complexity (AC:L), no authentication required (PR:N), and no user interaction (UI:N). However, the CVSS4 scope (S:X) and impact ratings (VC:L, VI:L, VA:L) suggest compartmentalized damage rather than system-wide compromise. The CVSS Evidence field (E:P) explicitly flags public exploit availability, elevating real-world risk. No EPSS score or KEV status provided, but the combination of publicly disclosed exploit code, network accessibility, zero authentication barriers, and SQL injection severity in a login-critical component (userchecklogin.php) creates high practical exploitation likelihood. SSVC factors: exploitation status is confirmed (POC exists); attack is automatable (SQL injection queries can be scripted); technical impact is moderate (data breach/modification but not system takeover). This warrants immediate patching for any internet-exposed instances. |
| Exploit ScenarioDerived | An attacker identifies a Simple Laundry System 1.0 instance exposed on the internet (or accessible within a network) and crafts a malicious HTTP request to /userchecklogin.php with a SQL injection payload in the userid parameter, such as userid=' OR '1'='1 or a time-based blind SQL injection. Since no authentication is required and the parameter is processed directly into a SQL query, the attacker retrieves sensitive database records (usernames, password hashes, transaction logs) or modifies data without legitimate credentials. Publicly available exploit code accelerates discovery and reduces the skill barrier for threat actors. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
SQL injection in code-projects Simple Laundry System 1.0 allows remote unauthenticated attackers to manipulate the userid parameter in /userchecklogin.php, enabling arbitrary SQL query execution with potential impact on data confidentiality, integrity, and availability. CVSS 6.9 reflects low-impact confidentiality, integrity, and availability effects without lateral propagation; exploit code is publicly available, increasing practical risk despite moderate CVSS scoring.
RemediationAI
No vendor-released patch version is identified at time of analysis. Immediate mitigation options include: (1) Apply parameterized SQL queries or prepared statements to the userid parameter validation in /userchecklogin.php to neutralize SQL injection; (2) Implement input validation/whitelist enforcement on userid to accept only expected alphanumeric or numeric formats; (3) If direct code patching is unavailable, restrict access to /userchecklogin.php via Web Application Firewall rules or authentication gateway until a patch is released. Contact code-projects.org for security advisory and patch availability; additional technical details are available via VulDB reference 356271 and the GitHub disclosure at lonelyuan/vunls/issues/1.
Affected ProductsAI
code-projects Simple Laundry System version 1.0 is the confirmed affected product. This appears to be a standalone PHP application marketed via code-projects.org and tracked in vulnerability databases including VulDB (CVE reference 356271). No version range, CPE identifier, or differentiation between patches or sub-versions is provided in available data. Deployment context is typically small-to-medium business laundry management, often in shared hosting environments.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from improper input validation on the userid parameter passed to /userchecklogin.php in a PHP-based web application (CWE-74: Improper Neutralization of Special Elements in Output). The user-supplied userid value is not sanitized before being incorporated into SQL queries, allowing an attacker to inject arbitrary SQL syntax. This is a classic web application vulnerability exploitable via HTTP GET or POST requests. The affected product is a standalone laundry management system written in PHP, typically deployed in shared hosting or small-business environments where input validation frameworks may be minimal.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /userchecklogin.php. Such manipulation of the argument userid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in Simple Laundry System Input Validation
View all 2In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB