CVE-2025-67146
CriticalSummary
Multiple SQL Injection vulnerabilities in GYM-MANAGEMENT-SYSTEM 1.0 by AbhishekMali21, in 'name' and 'id' parameters in various scripts. An unauthenticated attacker can inject malicious SQL commands, leading to unauthorized data extraction, authentication bypass, or database modification.
Risk Assessment
An attacker can access sensitive data, alter database contents, or bypass authentication, posing a serious threat to system integrity.
Recommendation
Apply patches or restrict access to the application, and use parameterized SQL queries.
Other vulnerabilities in GYM-MANAGEMENT-SYSTEM
See all- CVE-2025-12610Medium
A vulnerability was determined in CodeAstro Gym Management System 1.0. An unknown part of /admin/view-progress-report.php is affected, where manipulation of the ID argument can lead to SQL injection. The attack may be launched remotely and the exploit has been publicly disclosed.
- CVE-2025-12242Medium
A vulnerability has been found in CodeAstro Gym Management System 1.0. The file /admin/actions/check-attendance.php is affected. Manipulation of the argument ID leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed to the public.
- CVE-2025-11592Medium
A SQL injection vulnerability was detected in Gym Management System 1.0 in /admin/edit-equipmentform.php. Manipulation of the ID argument allows remote SQL injection. The exploit is public.
- CVE-2025-11589Medium
A SQL injection vulnerability was discovered in Gym Management System 1.0 in /admin/user-payment.php. Manipulation of the plan argument allows remote SQL injection. The exploit is public.
Original NVD description (English source)
Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, (2) trainer_search.php, and (3) gym_search.php, and via the 'id' parameter in (4) payment_search.php. An unauthenticated remote attacker can exploit these issues to inject malicious SQL commands, leading to unauthorized data extraction, authentication bypass, or modification of database contents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS