CodeAstro Gym Management System CVE-2025-11589

Exploitation requires VALID AUTHENTICATED ADMIN ACCESS to the CodeAstro Gym Management System. The attacker must possess or compromise credentials for an administrator account with permissions to access /admin/user-payment.php. The vulnerable 'plan' parameter must be passed to this endpoint without parameterized query protection. No special non-default configuration is required; the vulnerability exists in the standard application code. Successful exploitation is limited to data confidentiality leakage (reading database contents); no server-side impact, code execution, or data modification is possible, indicating the SQL context is read-only or heavily restricted.

This vulnerability presents low real-world risk despite public exploit availability. CVSS 2.1 score with CVSS:4.0 vector shows AV:N (network) but critically PR:L (requires login) and VC:L/VI:L/VA:L (low confidentiality, integrity, and availability impact). EPSS 0.03% percentile 8 indicates near-zero exploitation probability in the wild, suggesting either limited attacker interest in gym management systems or significant practical barriers to weaponization despite POC availability. The authenticated requirement substantially reduces risk compared to unauthenticated SQL injection; an attacker must first compromise or socially engineer an admin account. The constrained impact (confidentiality only, no server compromise) further limits severity. This is a textbook case of public POC availability not correlating with high real-world risk-organizations should prioritize this after addressing unauthenticated vulnerabilities.

An authenticated administrator with legitimate access to the gym management system submits a crafted SQL injection payload in the 'plan' parameter via GET or POST request to /admin/user-payment.php. The injected SQL query executes within the database context, allowing the attacker to extract sensitive data such as user payment records, membership details, or personal information stored in the database, but cannot modify data or execute system commands due to the constrained impact scope.