The Simple Laundry System 1.0 contains an unauthenticated SQL injection vulnerability that permits remote attackers to compromise the underlying database.

This is a SQL injection flaw (CWE-89) located in the delstaffinfo.php file. The application fails to properly sanitize the userid parameter, which allows an unauthenticated remote attacker to manipulate database queries.

Successful exploitation allows an attacker to gain unauthorized access to the database, potentially leading to sensitive data leakage, unauthorized data modification, or complete system compromise. With a CVSS score of 7.3, this vulnerability represents a high risk to business continuity and data integrity, as it provides a direct vector for attackers to bypass application logic and extract proprietary information.

Immediate Action: As no official patch is available, administrators should restrict network access to the delstaffinfo.php endpoint or disable the affected functionality entirely until the vendor provides a secure update.

Proactive Monitoring: Review web server access logs for anomalous GET requests containing SQL syntax patterns, such as UNION, SELECT, or SLEEP commands, targeting the delstaffinfo.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming traffic containing common SQL injection payloads directed at the userid parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced GitHub issue.

Given the availability of public exploit material and the lack of a vendor-supplied patch, this vulnerability poses a significant risk to any deployment of the Simple Laundry System. Organizations should prioritize isolating the affected system from public-facing networks and implement strict input validation at the WAF level to prevent unauthorized database access.