CodeAstro Gym Management System CVE-2025-11590

Exploitation requires valid authenticated credentials to access the /admin/equipment-entry.php administrative interface-the CVSS vector PR:L explicitly confirms that login is mandatory. The attacker must have administrative or staff-level access to the Gym Management System to reach the vulnerable endpoint, as it is located under /admin/. No default credentials or bypassable authentication mechanism is documented in the CVE description. The ename parameter must be processed by the underlying PHP script without prepared statements or input sanitization; however, it is unknown whether the SQL injection requires a specific HTTP method (GET vs. POST) or specific request format. The vulnerability is NOT conditioned on non-default configuration-it exists in the standard installation of version 1.0. The primary limiting factor is the authentication requirement, which prevents opportunistic internet-wide scanning and exploitation.

Despite the public availability of exploit code, real-world risk is LOW due to multiple mitigating factors. CVSS 4.0 vector shows PR:L (requires login), indicating authentication is mandatory-this significantly reduces attack surface compared to unauthenticated network vulnerabilities. EPSS score of 0.03% (8th percentile) suggests minimal exploitation likelihood in the wild, contradicting the public POC availability; this suggests the exploit is theoretical or targets a niche user base. CVSS impact metrics are uniformly LOW (VC:L, VI:L, VA:L) and SCOPE is NOT CHANGED, meaning an attacker with admin credentials cannot escalate privileges or affect other users. The E:P (Exploit Proof of Concept) rating confirms public availability but does not indicate active exploitation campaigns. Attack complexity is LOW (AC:L) and attack vector is NETWORK (AV:N), meaning the technical barrier is minimal once authentication is obtained-however, the authentication requirement itself is the primary control. SSVC decision framework would classify this as low priority: exploitation requires valid credentials, technical impact is limited to the authenticated user's data access, and no automatable exploitation chain is evident without administrative access. The mismatch between public POC and low EPSS suggests defensive uptake is effective or deployment footprint is small.

An authenticated administrator or user with admin panel access navigates to /admin/equipment-entry.php and submits a crafted value in the ename parameter such as ' OR '1'='1 or a UNION-based SQL injection payload. The PHP script concatenates this unsanitized input directly into a SQL query (e.g., SELECT * FROM equipment WHERE name = '[ename]'), allowing the attacker to modify the query logic, extract arbitrary database records, or potentially modify equipment data depending on the underlying SQL permissions and query structure. Public exploit code from https://github.com/coppeliaz/cve/issues/3 demonstrates the precise payload construction.