The Simple Laundry System 1.0 by code-projects contains a SQL injection vulnerability in the /searchguest.php file's Parameter Handler component. Specifically, the searchServiceId parameter is not properly sanitized, enabling remote attackers to inject SQL commands. This vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) and allows unauthenticated remote exploitation. Public exploit code is available, but no official fix or patch has been released as of the published date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication, increasing the risk of attack. However, the CVSS vector indicates low confidentiality, integrity, and availability impact, suggesting limited but non-negligible consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying temporary mitigations such as input validation or web application firewalls to block malicious payloads targeting the searchServiceId parameter. Monitor for vendor updates regarding an official patch.