CVE-2026-5257 is a SQL injection flaw (CWE-89) in code-projects Simple Laundry System 1.0, in /delstaffinfo.php, through the userid parameter. NVD scores it 7.3 high and says a public exploit exists. No fixed version is named, so remove public access and patch the query yourself.
What's affected
code-projects Simple Laundry System version 1.0, per the CVE record. The weak spot is the /delstaffinfo.php file, handled by the component the record calls Parameter Handler, and the userid argument is the input that reaches the database.
The record lists no patched release. Treat every copy of version 1.0 as affected until you have changed the code.
How to check if you're exposed
This is a downloadable PHP sample project, so there is no package manager entry to query. Look in your web root instead.
grep -rn "userid" --include=*.php /var/www/
Open /delstaffinfo.php and read how userid is used. If the value is placed into a SQL string by concatenation, the code is exposed. The file name suggests a delete action, so also check whether the page requires a logged in staff session before it runs.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Find every deployment of Simple Laundry System 1.0, including test and demo copies that were put online and forgotten.
- Take public instances offline or restrict them to a VPN or an allowlist of addresses until the code is fixed.
- Rewrite the query that uses
useridas a prepared statement with bound parameters, using PDO or mysqli, and cast numeric ids to integers before use. - Search web server and database logs for unusual values in this parameter and for SQL errors returned to clients.
- Use a dedicated low privilege database account for the app so that a query flaw cannot touch other schemas.
Why it matters
SQL injection (CWE-89, a child of the injection family CWE-74) happens when user input becomes part of a query instead of data passed to it. The write-up for this CVE states the cause plainly: the userid value is used directly in a SQL query without cleaning or validation.
A page that deletes staff records should sit behind authentication. The record scores this flaw as needing no privileges, so confirm in your copy whether anything guards the page. The record does not flag this CVE as a CISA Known Exploited Vulnerability, but it does say the exploit has been published.
Quick check
Is there a patch for Simple Laundry System 1.0?
None is named in the record or in the issue that reports it. Check the vendor site and the advisory for updates, and fix the query in your own copy if you must keep running it.
Does a web application firewall solve this?
It can block common attack strings and buy time, but it does not fix the query. The durable fix is a parameterized statement in the code.
Sources
Last reviewed: 19 October 2026.
