The vulnerability in code-projects Simple Laundry System 1.0 affects the /delstaffinfo.php file's Parameter Handler component. Specifically, the userid argument is not properly sanitized, leading to SQL injection. This allows an unauthenticated remote attacker to inject malicious SQL commands, potentially compromising the database. The CVSS 4.0 base score is 6.9 (medium), reflecting network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint and implement input validation or parameterized queries as a temporary mitigation.