EUVD-2026-17820
GHSA-8x4w-7f2x-x6c2
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Impact | The CVSS 4.0 vector indicates network-based attack with low complexity, no authentication required, and low confidentiality/integrity impact without availability impact (AV:N/AC:L/PR:N/UI:N/VC:L/VI:L/VA:L). The CVSS score of 6.9 reflects medium severity. However, real-world risk is elevated by multiple factors: the Attack Complexity is Low (AC:L), unauthenticated access is possible (PR:N), and critically, public exploit code exists (E:P tag indicates Proof of Concept available). While the direct confidentiality and integrity impacts are rated low due to CVSS constraints, SQL injection typically enables full database compromise, making this a practical high-risk vulnerability. The combination of low attack friction and public tooling makes this a genuine operational concern despite the moderate numeric score. |
| Exploit ScenarioDerived | An attacker without authentication discovers the Simple Laundry System 1.0 instance via network scanning. They craft an HTTP request to /delstaffinfo.php with a malicious userid parameter containing SQL syntax (e.g., userid=1 OR 1=1--), exploiting the lack of input validation. The injected SQL is executed server-side, allowing the attacker to enumerate database schema, extract user credentials, modify staff records, or in worst case, achieve remote code execution depending on database permissions. Public exploit code published on GitHub (reference: https://github.com/ningfashui123/louplus/issues/1) significantly lowers the barrier to exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 01, 2026
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to manipulate the userid parameter in /delstaffinfo.php, enabling arbitrary SQL query execution with limited data confidentiality and integrity impact. Public exploit code is available, increasing real-world risk despite the moderate CVSS score of 6.9.
RemediationAI
Immediate action is required to remediate this unauthenticated SQL injection. No vendor-released patch version is identified in available data, indicating the vendor may not have released an official update. Users must contact code-projects directly through https://code-projects.org/ for security updates. As an interim workaround, implement input validation and parameterized queries (prepared statements) in the /delstaffinfo.php file to neutralize the userid parameter; specifically, use prepared statements with bound parameters rather than string concatenation. Additionally, restrict network access to /delstaffinfo.php via WAF rules or IP whitelisting until a patch is available, and consider running the application only in isolated or development environments until remediated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the Parameter Handler component of Simple Laundry System, a PHP-based web application for laundry management. The root cause is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which encompasses SQL injection attacks. The /delstaffinfo.php file fails to properly sanitize or parameterize the userid input parameter before incorporating it into SQL queries, allowing attackers to inject arbitrary SQL syntax. This is a classic input validation failure in a web application's database interaction layer.
Know when Simple Laundry System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in code-projects Simple Laundry System 1.0. This issue affects some unknown processing of the file /delstaffinfo.php of the component Parameter Handler. Such manipulation of the argument userid leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in SourceCodester Simple Laundry System XSS
View all 4More in Simple Laundry System
View allSQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQ
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or
SQL injection in Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or
SQL injection in Simple Laundry System 1.0's /checkregisitem.php parameter handler allows unauthenticated remote attacke
SQL injection in Simple Laundry System 1.0 PHP application allows unauthenticated remote attackers to execute arbitrary
SQL injection in Simple Laundry System 1.0's /checklogin.php parameter handler allows unauthenticated remote attackers t
SQL injection in Simple Laundry System 1.0's /checkupdatestatus.php parameter handler allows unauthenticated remote atta
SQL injection in Simple Laundry System 1.0 through the serviceId parameter in /viewdetail.php allows unauthenticated rem
Cross-site request forgery in code-projects Laundry System 1.0 allows an attacker to perform unauthorized actions on beh
Cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows remote attackers to inject arbitrary script
Reflected cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers
Exploit-DB