CodeAstro Gym Management System CVE-2025-11593
LOWSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in CodeAstro Gym Management System 1.0. This vulnerability affects unknown code of the file /admin/actions/delete-equipment.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
AnalysisAI
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /admin/actions/delete-equipment.php. The vulnerability requires valid user credentials (PR:L) and has publicly available exploit code; however, the EPSS score of 0.03% and limited impact scope (VC:L/VI:L/VA:L) indicate low real-world exploitation probability despite technical exploitability.
Technical ContextAI
The vulnerability exists in PHP code handling database operations within the admin panel's equipment deletion endpoint. The ID parameter in /admin/actions/delete-equipment.php is not properly sanitized or parameterized before being incorporated into SQL queries, violating CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The affected product is a lightweight PHP-based gym management application (CPE: cpe:2.3:a:codeastro:gym_management_system:1.0:*:*:*:*:*:*:*) likely using direct string concatenation in SQL statement construction rather than prepared statements.
RemediationAI
Apply a security patch to version 1.1 or later once released by CodeAstro; contact vendor at https://codeastro.com/ for patched version availability. Immediate workaround: implement input validation and parameterized queries (prepared statements) in /admin/actions/delete-equipment.php to neutralize SQL injection - replace direct string concatenation with parameterized placeholders (e.g., PHP PDO with named parameters or mysqli prepared statements). Additionally, restrict access to /admin/ paths to internal IP ranges or a VPN, and audit database user privileges to ensure the PHP application runs with minimal required permissions (e.g., SELECT and DELETE on equipment table only, not full admin). These controls eliminate exploitation vectors while awaiting vendor patch.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today