An unauthenticated SQL injection vulnerability in the Simple Laundry System 1.0 allows remote attackers to compromise backend database integrity and confidentiality.

This is a SQL injection vulnerability (CWE-89) located in the delmemberinfo.php script. The application fails to sanitize the userid parameter before using it in database queries, allowing unauthenticated remote attackers to inject malicious SQL commands.

Successful exploitation permits unauthorized access to the underlying database, potentially leading to sensitive data exposure, unauthorized modification or deletion of records, and full system control. With a CVSS score of 7.3, this flaw poses a high risk to business continuity and data integrity, as it provides a direct path for attackers to bypass application-level security controls.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the delmemberinfo.php file or disable the affected functionality entirely until a vendor-supplied update is released.

Proactive Monitoring: Security teams should monitor web server logs for suspicious GET requests containing SQL syntax or unusual query patterns targeting the delmemberinfo.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting common parameters such as userid.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the provided GitHub repository issue.

Given the availability of public proof-of-concept code and the ease of exploitation, this vulnerability represents a significant risk to any environment hosting the Simple Laundry System. Administrators must prioritize implementing compensating controls or restricting access to the vulnerable script immediately, as the lack of an official patch leaves the system exposed to potential unauthorized data exfiltration or system compromise.