The Simple Laundry System 1.0 from code-projects contains an SQL injection vulnerability in the /userchecklogin.php script. The userid argument is not properly sanitized, allowing an attacker to inject malicious SQL commands remotely. This can potentially lead to unauthorized data access or manipulation. The CVSS 4.0 base score is 6.9, indicating a medium severity risk. No official fix or patch has been published, and the vendor has not provided remediation details. Exploit code has been disclosed publicly but no known exploitation in the wild has been reported.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data disclosure, modification, or deletion within the affected system. The vulnerability affects the confidentiality, integrity, and availability of the system to a limited extent as indicated by the CVSS vector. No confirmed active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint if possible and monitor for unusual activity. Avoid using version 1.0 of the Simple Laundry System in production environments where sensitive data is processed.