EUVD-2026-17577Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents a moderate real-world risk despite the low CVSS score of 5.3. The authentication requirement (PR:L) reduces immediate exposure compared to unauthenticated SQL injection, as attackers must first obtain valid credentials or compromise an existing user account. However, the CVSS v4.0 vector E:P field indicates proof-of-concept code is publicly available, increasing practical exploitation likelihood. The vulnerability affects a niche gym management application with likely limited user base, reducing the attack surface compared to mainstream software. SSVC framework considerations: exploitation is confirmed (POC available), but automation feasibility depends on authentication mechanism strength; technical impact is limited but could expose payment records, customer PII, or allow unauthorized transaction modification. Priority should reflect the authentication barrier and application scope, but the public exploit availability warrants prioritization for organizations running this software. |
| Exploit ScenarioDerived | An authenticated user of Simple Gym Management System (e.g., gym staff or customer with login credentials) submits a crafted SQL injection payload in the Payment_id or customer_id parameter when processing a payment transaction. The unvalidated input is directly concatenated into a SQL query, allowing the attacker to manipulate query logic-for example, injecting 'OR 1=1' to bypass payment authorization checks, retrieve all customer payment records, or modify transaction amounts in the database. Publicly available exploit code from the referenced GitHub issue simplifies weaponization for attackers with basic technical knowledge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 31, 2026
SQL injection in code-projects Simple Gym Management System 1.0 Payment Handler allows authenticated remote attackers to manipulate Payment_id, Amount, customer_id, payment_type, and customer_name parameters to execute arbitrary SQL queries, potentially leading to unauthorized data access or modification. Publicly available exploit code exists for this vulnerability; patch status from vendor remains unconfirmed.
RemediationAI
Organizations running Simple Gym Management System 1.0 should contact code-projects directly via https://code-projects.org/ to obtain a patched version addressing the SQL injection in the Payment Handler component. No specific vendor-released patch version was confirmed in available data at time of analysis. As an interim measure, restrict access to the Payment Handler component through network or application-level controls, limiting exposure to authenticated users only. Additionally, implement Web Application Firewall (WAF) rules to detect and block SQL injection syntax in payment parameters (Payment_id, Amount, customer_id, payment_type, customer_name). Database access should be configured with least-privilege principles, and input validation filters should be applied at the application level pending a vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from improper input validation and parameterization in the Payment Handler component of Simple Gym Management System, classified as CWE-89 (SQL Injection). The application fails to sanitize or use prepared statements for user-supplied input in payment-related parameters, allowing attackers to inject malicious SQL syntax. The CVSS v4.0 vector indicates the attack requires network access (AV:N), low complexity (AC:L), and authenticated login (PR:L), suggesting the Payment Handler is accessible to logged-in users without special privileges. The exploitation probability (E:P) is marked as Proof of Concept available, and the impact is limited to low confidentiality, integrity, and availability within the application context (VC:L/VI:L/VA:L).
Know when Simple Gym Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in code-projects Simple Gym Management System 1.0. This vulnerability affects unknown code of the component Payment Handler. The manipulation of the argument Payment_id/Amount/customer_id/payment_type/customer_name leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB