CodeAstro Gym Management System CVE-2025-11588

Exploitation requires: (1) valid credentials to authenticate to CodeAstro Gym Management System - attacker must be a registered user (member, staff, or admin) with access to the customer management interface; (2) ability to submit input to the fullname parameter in /customer/index.php - this is available through standard web UI or direct HTTP POST/GET requests; (3) database user account running the application must have SELECT/INSERT/UPDATE privileges (typical default). No special configuration or non-default settings are required. Limitations: authentication requirement prevents unauthenticated remote exploitation; SQL injection impact is constrained by database user permissions (no file system access or code execution unless database runs as privileged account); scope is limited to data accessible to the application account.

Risk assessment presents a significant disconnect between signal indicators. CVSS v4.0 score of 2.1 reflects primarily the authentication barrier (PR:L) and limited impact scope (VC:L/VI:L/VA:L with no changed scope), suggesting low severity by design. However, EPSS score of 0.03% (8th percentile) provides the most actionable real-world risk signal, indicating this vulnerability is rarely exploited despite public POC availability. This discrepancy suggests the threat landscape prioritizes vulnerabilities with lower friction (unauthenticated access) and broader deployment surfaces. Authentication requirement acts as primary friction factor; SQL injection typically achieves data exfiltration rather than system compromise in this context. Application's niche market (gym management) limits blast radius compared to mainstream platforms. The publicly available exploit and low EPSS suggest this is a known-but-dormant risk, actionable only if an organization runs this specific software and an attacker has valid credentials.

An authenticated gym member or staff user with access to the customer management section crafts a malicious fullname input containing SQL metacharacters (e.g., ' OR '1'='1) and submits it through the customer profile form. The application constructs an unsafe SQL query concatenating this untrusted input directly into a SELECT or UPDATE statement. The attacker's payload alters the query logic, allowing exfiltration of customer database records (names, contact info, payment data) or modification of membership records.