EUVD-2026-17819
GHSA-r35c-3wmc-xwh2
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Impact | The CVSS 6.9 score with vector AV:N/AC:L/AT:N/PR:N indicates a network-accessible vulnerability requiring no privileges or user interaction and low attack complexity. CVSS 4.0 scoring with E:P (Proof-of-Concept code published) reflects the realistic exploitation potential. The vulnerability lacks authentication barriers (PR:N), making it accessible to anonymous remote actors. While the impact scope is limited (VC:L/VI:L/VA:L-low confidentiality, integrity, and availability impact per the CVSS vector), SQL injection in a laundry system managing user accounts and transactions could expose personal data, modify service records, or enable privilege escalation. The public availability of exploit code elevates real-world risk despite the moderate CVSS score. This is a genuine priority for any organization running Simple Laundry System 1.0, particularly those processing personal or financial data, as SQL injection is routinely weaponized in automated scanning and mass exploitation campaigns. |
| Exploit ScenarioDerived | An attacker sends a POST or GET request to the /modify.php endpoint with a crafted firstName parameter containing SQL metacharacters, such as firstName=admin' OR '1'='1. The unsanitized parameter is directly concatenated into a database query, allowing the attacker to modify the query logic, bypass authentication checks, extract user data (names, payment details, account information), or alter service records within the laundry system database. Publicly released proof-of-concept code eliminates the need for skilled reverse engineering, enabling script-kiddie level exploitation at scale against deployed instances. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 01, 2026
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to manipulate the firstName parameter in /modify.php, enabling arbitrary database queries and potential data exfiltration or modification. The vulnerability affects the Parameter Handler component through CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Publicly available exploit code exists, and the CVSS 6.9 score reflects moderate impact with low attack complexity and no authentication requirement.
RemediationAI
Immediate mitigation requires upgrading Simple Laundry System to a patched version if available from code-projects.org; however, no explicit patched version number is confirmed in the available data. Users unable to upgrade immediately should implement input validation and parameterized queries (prepared statements) for the firstName parameter in /modify.php to prevent SQL injection. Recommended steps: (1) Replace all string concatenation in SQL queries with parameterized prepared statements using PHP's mysqli or PDO libraries; (2) Apply strict input validation to reject or escape special SQL characters in the firstName field; (3) Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in /modify.php requests; (4) Review database user permissions to apply least-privilege principles, limiting the laundry system's database account to only necessary operations. Additional technical guidance is available from the VulDB submission and GitHub issue referenced at https://github.com/kunlan567-boop/test/issues/1 and https://vuldb.com/vuln/354446.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the Parameter Handler component of Simple Laundry System 1.0, specifically within the /modify.php file. The root cause is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which indicates insufficient input validation or sanitization of user-supplied parameters before use in SQL queries. The firstName parameter is passed unsanitized into a downstream SQL context, allowing attackers to inject arbitrary SQL commands. This is a classic PHP-based SQL injection flaw where user input is concatenated directly into query strings without prepared statements or parameterized query mechanisms.
Know when Simple Laundry System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /modify.php of the component Parameter Handler. This manipulation of the argument firstName causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in SourceCodester Simple Laundry System XSS
View all 4More in Simple Laundry System
View allSQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQ
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or
SQL injection in Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or
SQL injection in Simple Laundry System 1.0's /checkregisitem.php parameter handler allows unauthenticated remote attacke
SQL injection in Simple Laundry System 1.0 PHP application allows unauthenticated remote attackers to execute arbitrary
SQL injection in Simple Laundry System 1.0's /checklogin.php parameter handler allows unauthenticated remote attackers t
SQL injection in Simple Laundry System 1.0's /checkupdatestatus.php parameter handler allows unauthenticated remote atta
SQL injection in Simple Laundry System 1.0 through the serviceId parameter in /viewdetail.php allows unauthenticated rem
Cross-site request forgery in code-projects Laundry System 1.0 allows an attacker to perform unauthorized actions on beh
Cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject arbitrary script
Reflected cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers
Exploit-DB