CodeAstro Gym Management System CVE-2025-12261

Exploitation requires authenticated access to the admin panel of CodeAstro Gym Management System 1.0 with sufficient privileges to interact with the announcement removal function. The attacker must have valid admin credentials or have compromised an admin account-unauthenticated remote attackers cannot trigger this vulnerability. The vulnerable endpoint /admin/actions/remove-announcement.php must be accessible and functional in the deployment. Non-default configuration or specific features do not limit the attack; it affects standard installations. The limiting factor is the authentication requirement (PR:L in CVSS vector), which significantly narrows the threat actor pool to insiders, compromised admin accounts, or attackers with valid credentials obtained through credential theft or phishing.

Despite the CVSS 4.0 score, real-world risk is significantly mitigated by multiple factors. The CVSS vector specifies PR:L (low privilege requirement), meaning attackers must first obtain authenticated admin-panel access-a substantial prerequisite that eliminates casual remote exploitation. The EPSS score of 0.01% (1st percentile) indicates security researchers estimate negligible probability of practical exploitation in the wild, contradicting the public POC availability; this suggests the vulnerability, while technically exploitable, requires preconditions (valid admin credentials, specific deployment configurations) that limit widespread abuse. The impact scope is restricted to Low/Low/Low (Confidentiality/Integrity/Availability), meaning even successful exploitation yields minimal data theft or service disruption. Attack Complexity is Low and no user interaction required, so once an authenticated attacker gains access, exploitation is straightforward-but the authentication requirement is the controlling factor in real risk. This is a high-CVSS-but-low-real-risk case: prioritize patching if you run this software, but this is not a critical incident vector compared to unauthenticated flaws.

An authenticated admin user with legitimate access to the gym management system's admin panel navigates to the remove-announcement functionality and, instead of using the standard UI, crafts a malicious HTTP request with a SQL injection payload in the ID parameter (e.g., ID=1' OR '1'='1 or ID=1 UNION SELECT username, password FROM users --). The unvalidated input flows directly into a SQL query, allowing the attacker to extract sensitive data (user credentials, member information) or modify database records (disable other admins, alter billing data). Publicly available exploit code on GitHub (https://github.com/JeromClown/cve/issues/1) provides a ready-made proof of concept, though real-world exploitation remains rare due to the authentication prerequisite.