The Simple Laundry System 1.0 by code-projects contains an SQL injection vulnerability in the /userfinishregister.php file's Parameter Handler component. Specifically, the firstName parameter is improperly sanitized, allowing an attacker to inject SQL commands remotely without any privileges or user interaction. This vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity impact. The vulnerability is publicly disclosed with an exploit published, but no vendor-provided fix or mitigation is currently documented.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access or modification with limited confidentiality, integrity, and availability impact as indicated by the CVSS vector. However, the overall severity is medium, reflecting partial impact and limited scope of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is documented, users should monitor for vendor updates. Until a patch is available, restricting access to the affected endpoint and employing web application firewalls with SQL injection detection rules may help reduce risk.