An unauthenticated SQL injection vulnerability in code-projects Simple Laundry System 1.0 poses a critical risk of unauthorized database access and potential system compromise.

This is a SQL injection vulnerability located in the searchguest.php file. The application fails to properly sanitize the searchServiceId parameter, allowing an unauthenticated attacker to inject arbitrary SQL commands.

Successful exploitation of this flaw allows attackers to bypass authentication, extract sensitive information, modify or delete database records, and potentially gain full control over the underlying database server. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality, integrity, and availability, which could lead to severe operational disruption and loss of proprietary data.

Immediate Action: As there is no official patch available, administrators should restrict access to the /searchguest.php endpoint or disable the affected functionality entirely until a secure update is provided by the vendor.

Proactive Monitoring: Review database access logs for anomalous query patterns, such as unexpected syntax characters (e.g., OR, SLEEP, UNION) originating from the searchServiceId parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads targeting the searchServiceId parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub security issue referenced by the vulnerability record.

Given the availability of public proof-of-concept code and the ease of exploitation, this vulnerability should be prioritized for mitigation. Organizations currently running Simple Laundry System 1.0 must implement compensating controls or restrict network access to the application immediately to prevent unauthorized database access.