EUVD-2026-14310Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS 3.1 score of 4.7 (Low-to-Medium severity) reflects limited attack surface due to the high privilege requirement (PR:H), multiple signals indicate elevated real-world risk. The CVSS vector shows AV:N (network-accessible), AC:L (low complexity), and C:L/I:L/A:L (confidentiality, integrity, and availability impact), meaning authenticated administrative users can cause measurable harm. The exploitation rating (E:P) and reproducibility (RC:R) confirm public proof-of-concept availability; the VulDB disclosure and GitHub repositories document working exploits. The high privilege requirement (PR:H) is the primary limiting factor—only administrators or trainers with elevated access can exploit this. However, in many small gym operations, administrative credentials may be widely shared or poorly managed, reducing this barrier. The combination of public POC availability, network accessibility, and confirmed exploitability makes this a real priority for deployments despite the modest CVSS score, particularly for organizations with weak credential hygiene. |
| Exploit ScenarioDerived | An authenticated gym administrator or trainer account with high-level privileges accesses the Simple Gym Management System and submits a malicious SQL injection payload in the Trainer_id or fname parameter (e.g., through an admin form or API endpoint in /gym/func.php). The attacker uses time-based blind SQL injection to systematically query the database—for example, injecting |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 22, 2026
SQL injection in Simple Gym Management System up to version 1.0 allows remote attackers with high privileges to manipulate the Trainer_id and fname parameters in /gym/func.php, enabling unauthorized database queries and potential data exfiltration or modification. Public exploit code exists for this vulnerability, and no patch is currently available.
Earlier versions of this analysis (1)
A SQL injection vulnerability exists in code-projects Simple Gym Management System version 1.0 and earlier, located in the /gym/func.php file affecting the Trainer_id and fname parameters. An authenticated attacker with high privileges can remotely exploit this vulnerability to extract, modify, or delete database contents. Public proof-of-concept exploits including time-based blind SQL injection techniques are available, increasing immediate risk.
RemediationAI
Immediate actions include: (1) Upgrade to a patched version if available from code-projects (check https://code-projects.org/ or contact the vendor directly, as no official patch advisory is referenced); (2) if patching is unavailable, implement parameterized queries (prepared statements) with bound parameters in /gym/func.php for all database interactions involving Trainer_id and fname; (3) enforce strict input validation using whitelisting and type-checking; (4) restrict administrative access to /gym/func.php endpoints to trusted IP ranges and require multi-factor authentication for admin accounts; (5) apply principle of least privilege to database accounts used by the application; (6) enable SQL query logging and monitoring to detect injection attempts. Interim network-level mitigations include deploying a Web Application Firewall (WAF) with rules to block common SQL injection patterns in the Trainer_id and fname parameters.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic SQL injection (CWE-89) flaw in PHP-based web application code where user-supplied input from the Trainer_id and fname parameters is insufficiently sanitized before being incorporated into SQL queries. The affected product, identified via CPE cpe:2.3:a:code-projects:simple_gym_management_system:*:*:*:*:*:*:*:*, is a gym management system written in PHP that fails to use parameterized queries or adequate input validation. The disclosed exploits utilize time-based blind SQL injection techniques, meaning attackers can infer database structure and contents through timing delays in database responses, even without direct error messages.
Know when Simple Gym Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been found in code-projects Simple Gym Management System up to 1.0. This affects an unknown part of the file /gym/func.php. Such manipulation of the argument Trainer_id/fname leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Organizations using code-projects Simple Gym Management System should be aware of moderate risk from CVE-2026-4550, a SQL injection vulnerability rated CVSS 4.7. Exploitation could allow attackers to execute code or inject malicious input. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB