CodeAstro Gym Management System CVE-2025-11591
LOWSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/actions/delete-member.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
AnalysisAI
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /admin/actions/delete-member.php, enabling unauthorized database queries with limited confidentiality and integrity impact. The vulnerability requires valid administrative credentials and carries a CVSS score of 2.1 with low confidentiality and integrity impact but no availability risk. Publicly available exploit code exists, though real-world exploitation remains extremely limited based on a 0.03% EPSS score.
Technical ContextAI
The vulnerability is a SQL injection flaw (CWE-74) in a PHP-based gym management system's administrative member deletion endpoint. The issue stems from insufficient input validation on the ID parameter passed to /admin/actions/delete-member.php, allowing an attacker to inject arbitrary SQL commands into database queries. The affected product is CodeAstro Gym Management System version 1.0, a niche administrative management application. SQL injection in this context is constrained by the CVSS vector (PR:L - requires authenticated login, VC:L/VI:L - low confidentiality and integrity impact, VA:L - no availability impact), suggesting the injection is either filtered to read-only queries or sandboxed within the scope of member-related data.
RemediationAI
Apply a security patch from CodeAstro if available by visiting https://codeastro.com/ to check for updates beyond version 1.0. If no patched version is available, implement input validation on the ID parameter using parameterized queries (prepared statements) in /admin/actions/delete-member.php to prevent SQL injection; this requires code review and patching by the vendor. As a compensating control, restrict network access to the /admin directory using Web Application Firewall (WAF) rules or reverse proxy authentication to allow only trusted administrative IP ranges, reducing the attack surface. This mitigates the requirement for an attacker to have legitimate administrative credentials. Additionally, enable SQL query logging and rate-limiting on the delete-member endpoint to detect exploitation attempts. Contact CodeAstro support directly for patch availability status.
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today