The Simple Laundry System 1.0 by code-projects contains a SQL injection vulnerability in the /delmemberinfo.php file's Parameter Handler component. Specifically, the userid parameter is not properly sanitized, allowing an attacker to inject malicious SQL code remotely without any privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. No official fix or patch has been published as of the vulnerability disclosure date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the CVSS vector indicates limited confidentiality, integrity, and availability impacts, suggesting partial but not complete compromise. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or parameterized queries as a temporary mitigation to prevent SQL injection via the userid parameter in /delmemberinfo.php.