This vulnerability in Simple Laundry System 1.0 involves improper sanitization of the userid parameter in /modstaffinfo.php, enabling remote attackers to inject malicious scripts via cross-site scripting. The flaw resides in the Parameter Handler component and can be exploited without authentication. The vulnerability is publicly known, but no vendor-provided fix or mitigation details have been published as of now.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability requires user interaction (UI:P) and has no privileges or user consent required for the attacker, but the impact is limited to client-side script execution. There is no indication of server-side compromise or data breach from the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting the userid parameter. Additionally, reviewing and sanitizing input handling in /modstaffinfo.php may reduce risk. Monitor vendor channels for updates or patches.