The Simple Laundry System 1.0 from code-projects contains a SQL injection vulnerability in the /userfinishregister.php file's Parameter Handler. Specifically, the firstName parameter is not properly sanitized, allowing an attacker to inject SQL commands remotely. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. No official fix or patch has been published, and the vendor has not provided remediation details. Exploit code is publicly available, but no active exploitation has been confirmed.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion, depending on the database privileges. The vulnerability has a medium severity rating with limited scope and impact as per the CVSS vector. There are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as temporary mitigations to prevent SQL injection via the firstName parameter. Monitoring for unusual database activity related to this endpoint is also advisable. Avoid exposing the vulnerable endpoint to untrusted networks if possible.