PT-2026-2301 · Unknown · Gym Management System

Published 2026-01-12 · Updated 2026-01-27 · CVE-2025-67146

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions AbhishekMali21 GYM-MANAGEMENT-SYSTEM version 1.0

Description The application contains multiple SQL Injection flaws. These issues are present via the name parameter in the member search.php, trainer search.php, and gym search.php files, and via the id parameter in the payment search.php file. A remote attacker who does not need to be authenticated can inject malicious SQL commands. Successful exploitation could lead to unauthorized data extraction, authentication bypass, or modification of database contents.

Recommendations Apply input validation and sanitization to the name parameter in member search.php. Apply input validation and sanitization to the name parameter in trainer search.php. Apply input validation and sanitization to the name parameter in gym search.php. Apply input validation and sanitization to the id parameter in payment search.php.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-67146

Affected Products

Gym Management System

References · 7

• 🔥 https://github.com/AbhishekMali21/GYM-MANAGEMENT-SYSTEM/issues/4 · Exploit
• https://osv.dev/vulnerability/CVE-2025-67146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67146 · Security Note
• https://t.me/cveNotify/150031 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2010927158152101909 · Twitter Post
• https://twitter.com/CVEnew/status/2010829914824425915 · Twitter Post
• https://twitter.com/CveFindCom/status/2010844022219112824 · Twitter Post