CodeAstro Gym Management System CVE-2025-12242

Authentication as an administrator user is mandatory - the CVSS vector PR:L (privilege level: low) confirms that any valid admin account can execute this attack. The ID parameter in /admin/actions/check-attendance.php must accept attacker-controlled input without sanitization. No user interaction (UI:N) is required once admin login is achieved. The vulnerability is specific to CodeAstro version 1.0; no other versions are documented. Exploitation is limited to partial data disclosure and modification (VC:L/VI:L/VA:L), not full system compromise. The attack does NOT require special network configuration or non-default settings - standard admin access to the check-attendance.php endpoint is sufficient.

Multiple signals reveal this is a low-priority vulnerability despite public exploit availability: (1) CVSS 4.0 vector requires PR:L (login required), eliminating unauthenticated remote exploitation; (2) Impact scope is confined to partial loss of confidentiality and integrity (VC:L/VI:L/VA:L), with no availability impact - attackers cannot disable the system; (3) EPSS score of 0.03% (8th percentile) indicates minimal real-world exploitation probability despite POC availability, suggesting the attack requires specific organizational setup or admin compromise; (4) Attack complexity is low (AC:L) and network-accessible (AV:N), making it feasible once credentials exist, but the authentication barrier significantly limits threat surface. This is NOT a zero-day (POC disclosed), and not actively weaponized at scale. Organizations with strong admin credential hygiene face minimal practical risk; those with weak admin account management should treat this as a moderate-priority patching item to prevent privilege escalation chains.

A disgruntled employee with valid admin credentials logs into the CodeAstro Gym Management System. Instead of using the normal UI to check attendance, the employee crafts a malicious HTTP request to /admin/actions/check-attendance.php with a SQL injection payload in the ID parameter, such as ID=1' OR '1'='1. The injected SQL query extracts sensitive membership data (names, contact info, billing details) from the database, or modifies attendance records to cover unauthorized access to gym facilities.