CodeAstro Gym Management System CVE-2025-11593

Exploitation requires an authenticated session with at least low-privilege admin or staff account (PR:L per CVSS). No special product configuration or non-default setup is needed - the vulnerability exists in the default codebase of version 1.0. The attack is limited to database operations visible to the authenticated user's role; a typical staff account may not have access to sensitive financial or personnel records depending on role-based access control (RBAC) implementation, which further constrains real-world damage. Exploitation does NOT require user interaction (UI:N) and succeeds over the network (AV:N), but the prerequisite of valid credentials prevents unauthenticated remote exploitation.

Risk is substantially lower than the CVSS 2.1 score alone suggests when all signals are synthesized. The CVSS:4.0 vector indicates network accessibility (AV:N) and low complexity (AC:L), but authentication is required (PR:L - low-privilege user). The impact is confined to confidentiality, integrity, and availability at the local scope only (VC:L/VI:L/VA:L with SC:N/SI:N/SA:N), meaning successful exploitation affects only that authenticated user's data session, not the broader system. EPSS at 0.03% (8th percentile) is exceptionally low, suggesting minimal real-world exploitation activity despite POC availability - typical for low-impact vulnerabilities in niche management software. The exploit is published but requires valid login credentials, which significantly narrows the attacker pool. This is a security flaw that should be patched but ranks below network-accessible unauthenticated vulnerabilities in prioritization.

An authenticated gym staff member (or attacker with stolen low-privilege credentials) navigates to the equipment deletion admin panel, modifies the ID parameter in the URL or POST request to inject SQL code (e.g., ?id=1 OR 1=1), and retrieves sensitive database records such as member information, payment details, or class schedules, or modifies/deletes data. The publicly available POC from https://github.com/coppeliaz/cve/issues/6 demonstrates the exact injection payload required.