CodeAstro Gym Management System
CVE-2025-11588
LOW
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was identified in CodeAstro Gym Management System 1.0. This impacts an unknown function of the file /customer/index.php. Such manipulation of the argument fullname leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
AnalysisAI
SQL injection in CodeAstro Gym Management System 1.0 via the fullname parameter in /customer/index.php allows authenticated remote attackers to execute arbitrary SQL queries with low confidentiality, integrity, and availability impact. Publicly available exploit code exists; however, the EPSS score of 0.03% (8th percentile) suggests minimal real-world exploitation despite public POC availability, likely due to authentication requirement and narrow deployment scope of this niche management application.
Technical ContextAI
The vulnerability is a classic SQL injection (CWE-74: Improper Neutralization of Special Elements used in an SQL Command) occurring in a PHP-based web application. The fullname parameter in the customer management module (/customer/index.php) fails to properly sanitize or parameterize user input before inclusion in SQL queries. CVSS vector AV:N/AC:L indicates network-accessible vulnerability with low attack complexity, but PR:L (privilege level: low) mandates prior authentication, reducing attack surface. The CWE-74 classification confirms unsafe dynamic SQL construction without prepared statements or input validation.
RemediationAI
No vendor-released patch identified at time of analysis. Immediate remediation requires applying input validation and parameterized queries to the fullname parameter in /customer/index.php. Recommended compensating controls: (1) Implement parameterized prepared statements (e.g., using PDO or mysqli prepared statements in PHP) for all SQL queries handling the fullname parameter - this eliminates SQL injection regardless of input content but requires code modification; (2) Apply strict input validation on fullname to alphanumeric characters and spaces only, rejecting SQL metacharacters (single quotes, semicolons, dashes, parentheses) - this is less robust than parameterization but can reduce attack surface if parameterization is blocked by legacy architecture; (3) Restrict database user permissions for the application account to SELECT/INSERT/UPDATE only on required tables, denying CREATE/DROP/ALTER - this limits damage from SQL injection to data exfiltration rather than schema destruction, with no performance impact but requires database reconfiguration; (4) Enable SQL query logging and Web Application Firewall (WAF) rules to detect SQL injection patterns in the fullname parameter, alerting on union-based or time-based SQL injection signatures - provides detection but not prevention, useful for incident response. Contact CodeAstro for patch availability at https://codeastro.com/.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today