EUVD-2026-15183
GHSA-j37h-g6v5-pj8h
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents a significant real-world risk despite being in a niche application. The CVSS score of 7.3 (High) reflects the network-based attack vector with low complexity and no privilege requirements, enabling unauthenticated remote exploitation. The availability of a public proof-of-concept exploit (https://github.com/zzb1388/cve2/issues/1) dramatically increases exploitation likelihood, as attackers can leverage existing code without developing their own exploits. The CVSS environmental metrics show Exploit Maturity as Proof-of-concept (E:P), confirming active exploit availability. While there is no indication of KEV listing or active widespread exploitation, the low technical barrier combined with public exploit code makes this a genuine priority for organizations running this software. The impact allows confidentiality, integrity, and availability compromise (C:L/I:L/A:L), enabling data theft, modification, and potential service disruption. Organizations should treat this as high-priority despite the software's limited deployment footprint. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a Simple Laundry System installation and accesses the publicly available proof-of-concept from GitHub (https://github.com/zzb1388/cve2/issues/1). The attacker crafts a malicious HTTP request to /checkcheckout.php with a SQL injection payload in the serviceId parameter, such as injecting UNION-based queries to extract sensitive data from the database including customer information, payment records, or administrative credentials. With low attack complexity and no authentication required, the attacker can automate this exploitation across multiple installations to harvest data or modify pricing information and transaction records. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
SQL injection in Simple Laundry System 1.0 PHP application allows unauthenticated remote attackers to execute arbitrary database queries through the serviceId parameter in /checkcheckout.php. Public exploit code exists for this vulnerability, and no patch is currently available.
Earlier versions of this analysis (1)
A SQL injection vulnerability exists in Simple Laundry System version 1.0, specifically in the /checkcheckout.php file's Parameter Handler component where the serviceId parameter is not properly sanitized. This remotely exploitable vulnerability requires no authentication or user interaction (CVSS AV:N/AC:L/PR:N/UI:N), allowing attackers to access, modify, or delete database information. A public proof-of-concept exploit has been published on GitHub, significantly lowering the barrier to exploitation.
RemediationAI
No official patch or updated version has been identified in the available references, as indicated by the CVSS Remediation Level of Unavailable (RL:X). Organizations running Simple Laundry System 1.0 should immediately implement input validation and parameterized queries for the serviceId parameter in /checkcheckout.php as a code-level fix. As interim mitigations, deploy a web application firewall (WAF) configured with SQL injection detection rules to filter malicious requests targeting this parameter, restrict network access to the application to trusted IP ranges only, implement principle of least privilege for the database user account used by the application to limit potential damage from successful exploitation, and conduct thorough logging and monitoring of all requests to /checkcheckout.php for anomalous patterns. Consider replacing the application with a maintained alternative if vendor support and patching are not forthcoming, as the application appears to be an unmaintained code project based on the distribution source.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects code-projects Simple Laundry System 1.0 (CPE: cpe:2.3:a:code-projects:simple_laundry_system:*:*:*:*:*:*:*:*), a PHP-based web application for managing laundry services. The root cause is CWE-89 (SQL Injection), which occurs when user-supplied input is not properly validated or sanitized before being incorporated into SQL queries. In this case, the serviceId parameter in the /checkcheckout.php file's Parameter Handler is vulnerable to SQL injection attacks, allowing attackers to manipulate database queries by injecting malicious SQL commands. This represents a fundamental input validation failure in the application's database interaction layer.
Know when Simple Laundry System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /checkcheckout.php of the component Parameter Handler. The manipulation of the argument serviceId results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Executive ViewAI
A critical SQL injection vulnerability in Simple Laundry System version 1.0 allows unauthenticated attackers to remotely access, modify, or delete database information without authentication. With a public exploit available and no patch currently available, this poses an immediate risk to data integrity and confidentiality for any organization using this system.
Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the serviceId parameter; restrict network access to /checkcheckout.php through firewall rules or IP whitelisting; disable the checkout functionality until a patch is available if operationally feasible; implement database activity monitoring (DAM) to detect unauthorized queries; apply principle of least privilege to database service accounts; consider running the application in a segregated network segment with restricted outbound access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in College Management System SQL Injection
View all 2More in Simple Laundry System
View allSQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQ
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or
SQL injection in Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or
SQL injection in Simple Laundry System 1.0's /checkregisitem.php parameter handler allows unauthenticated remote attacke
SQL injection in Simple Laundry System 1.0's /checklogin.php parameter handler allows unauthenticated remote attackers t
SQL injection in Simple Laundry System 1.0's /checkupdatestatus.php parameter handler allows unauthenticated remote atta
SQL injection in Simple Laundry System 1.0 through the serviceId parameter in /viewdetail.php allows unauthenticated rem
Cross-site request forgery in code-projects Laundry System 1.0 allows an attacker to perform unauthorized actions on beh
Cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject arbitrary script
Reflected cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers
Cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject malicious script
Exploit-DB