An unauthenticated SQL injection vulnerability in code-projects Simple Laundry System 1.0 poses a significant risk of unauthorized database access and potential data compromise.

The application is susceptible to SQL injection due to improper neutralization of the firstName parameter within the /userfinishregister.php script. This flaw allows an unauthenticated attacker to execute arbitrary SQL commands against the backend database.

Successful exploitation allows an attacker to gain unauthorized access to the underlying database, potentially leading to sensitive data leakage, unauthorized modification of records, or complete system compromise. With a CVSS score of 7.3, this vulnerability represents a high-risk entry point that could facilitate data breaches and disrupt business operations.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /userfinishregister.php endpoint or disable the registration feature until a formal update is provided by the vendor.

Proactive Monitoring: Security teams should monitor database logs for anomalous queries, particularly those containing SQL syntax or time-based delay commands, and investigate any unexpected attempts to access the user registration endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the firstName parameter.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research write-up at https://github.com/yao536/cve/issues/2.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability presents an immediate risk. Organizations utilizing Simple Laundry System 1.0 must prioritize the implementation of compensating controls, such as WAF rules or network segmentation, and monitor for unauthorized access attempts until a secure version is released.