CodeAstro Gym Management System CVE-2025-11592

Exploitation requires valid administrator-level credentials (privilege level L) to access /admin/edit-equipmentform.php. The endpoint must be reachable over the network (AV:N confirmed), but successful SQL injection execution depends on: (1) the ID parameter being passed unsanitized to a SQL query; (2) database error messages or blind SQL timing indicators being observable (technique-dependent); (3) the attacker holding at least low-privilege admin access to the system. This is NOT an unauthenticated remote code execution-a critical distinction. Default-deployed CodeAstro GMS systems with weak admin password practices or exposed admin panels to untrusted networks are at higher risk. Single-factor authentication and centralized credential storage without monitoring create secondary exploitation risk. Systems deployed with proper access controls, MFA, and IP-based admin panel restrictions significantly reduce exploitability despite the presence of public POC code.

This vulnerability presents a paradoxical risk profile requiring careful contextualization. The CVSS v4.0 score of 2.1 is extremely low, reflecting both the authentication requirement (PR:L) and severely limited impact scope (confidentiality, integrity, and availability all rated Low with no scope expansion). The EPSS score of 0.03% (8th percentile) indicates minimal statistical likelihood of real-world exploitation, placing this in the least-exploited CVE tier. However, publicly available exploit code exists, creating a minor tension: POC availability does not equal active exploitation. The description states exploit 'may be used' rather than confirming active KEV listing. For threat assessment: this is a low-priority vulnerability suitable for standard patching cycles rather than emergency response. Organizations running CodeAstro GMS 1.0 should prioritize if they allow untrusted administrators or if administrator accounts have been compromised, but the low CVSS, low EPSS, and low-privilege requirement significantly reduce panic urgency. The actual risk depends heavily on internal access controls-a single-admin system differs vastly from a multi-user system with weak credential hygiene. No conflict between signals; they consistently indicate low real-world risk despite POC availability.

An authenticated administrator account with malicious intent or one compromised via phishing/password reuse executes a crafted HTTP GET/POST request to /admin/edit-equipmentform.php?ID=1 OR 1=1, causing the backend SQL query to execute an injected WHERE clause that returns unauthorized equipment records or modifies database entries. Alternatively, if the backend uses UNION-based injection, the attacker could extract sensitive gym member data (names, contact info, payment details) stored in adjacent tables. The publicly available POC on GitHub (https://github.com/coppeliaz/cve/issues/5) likely demonstrates one of these techniques.