code-projects Gym Management System CVE-2026-7553

Exploitation requires the attacker to possess valid administrator credentials (PR:H) to access the /admin/edit_exercises.php endpoint; the vulnerability cannot be exploited by unauthenticated remote users. The edit_exercise parameter must be directly processed by the backend without input validation, sanitization, or prepared statement protection-this is the EXACT condition stated in the vulnerability description ('The manipulation of the argument edit_exercise results in sql injection'). Default configurations of Gym Management System 1.0 appear to be vulnerable; non-default hardening (e.g., database user permissions restricted to SELECT-only, input validation middleware) could mitigate exploitation even if the code flaw persists. The attack requires no user interaction (UI:N) and operates across the network (AV:N/AC:L), but the high-privilege prerequisite (PR:H) is the critical limiting factor that prevents widespread unauthenticated attacks.

The CVSS 4.7 score reflects a constrained threat model: while the attack vector is network-based (AV:N) with low complexity (AC:L), the requirement for high-privilege credentials (PR:H) substantially limits real-world exploitation. The CVSS environmental extensions (E:P, RL:X, RC:R) indicate the exploit is public and reproducible but remediation status is unspecified. The vulnerability does not yield complete system compromise-confidentiality, integrity, and availability impacts are all marked 'Low' (C:L/I:L/A:L), meaning an attacker cannot read entire databases, modify arbitrary data, or cause total service denial. Without EPSS data or CISA KEV confirmation, exploitation probability appears contained to insider threats (malicious admins) or compromise of admin accounts. The existence of public exploit code lowers the barrier to abuse once credentials are obtained, but does not indicate widespread active exploitation against unauthenticated targets. For organizations where admin accounts are strongly controlled, real risk is moderate; for those with weak admin access controls, risk escalates to high due to insider threat potential.

An attacker with valid administrator credentials logs into the Gym Management System admin panel and navigates to the edit exercises page. They craft a malicious SQL injection payload in the edit_exercise parameter (e.g., edit_exercise=1' UNION SELECT user(), version(), database() -- ) and submit the request. The unfiltered input is concatenated into the backend SQL query, causing the database to execute the injected commands, returning sensitive database metadata or user credentials to the attacker. The attacker could then exfiltrate further data or modify exercise records to corrupt system integrity.