CodeAstro Gym Management System CVE-2025-11591

Exploitation requires valid administrative login credentials (PR:L - privilege level authenticated). The vulnerability is triggered by manipulation of the ID parameter in /admin/actions/delete-member.php during a member deletion action. No special configuration or non-default settings are implied by the CVE description; standard CodeAstro Gym Management System 1.0 deployments with admin access are vulnerable. The attack is limited to remote network access with authenticated privileges; unauthenticated attackers cannot trigger the vulnerability. Impact is bounded to confidentiality and integrity of member data at low severity, not system-wide compromise.

This vulnerability presents a low real-world risk despite public exploit availability. The CVSS score of 2.1 is exceptionally low, driven by three factors: authenticated access requirement (PR:L), limited impact scope (VC:L/VI:L, no VA), and attack complexity of Low. The EPSS score of 0.03% percentile 8% further indicates minimal exploitation likelihood in the wild, suggesting the combination of niche product, administrative-only access, and limited impact makes this an unattractive target despite public POC code. The E:P flag in the CVSS vector confirms the exploit is publicly available and impacts the scoring, but the overall risk profile suggests this is a proof-of-concept vulnerability in a low-volume product rather than an active threat. Defenders should prioritize this only if they deploy this specific gym management system; for most organizations, this is not a priority item. The conflict between 'publicly available exploit' (suggests higher risk) and '0.03% EPSS' (suggests negligible real-world adoption or exploitation) indicates this vulnerability has not gained traction despite disclosure.

An authenticated administrator or compromised admin account executes a crafted HTTP request to /admin/actions/delete-member.php with a malicious ID parameter containing SQL injection payload (e.g., ID=1 OR 1=1 --). The injected SQL command extracts sensitive member data from the database, allowing the attacker to read member records beyond their authorized scope. The attack requires valid login credentials but no additional user interaction.