PT-2026-27012 · Code Projects · Simple Gym Management System

Ahmadmarzook · CVE-2026-4550 · Published 2026-03-22 · Updated 2026-03-23

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple Gym Management System versions prior to 1.1

Description A SQL injection issue exists in code-projects Simple Gym Management System. The issue is located in an unknown part of the /gym/func.php file. Manipulation of the Trainer id/fname argument can lead to SQL injection. The attack can be executed remotely. The exploit has been publicly disclosed.

Recommendations Update to version 1.1 or later. As a temporary workaround, sanitize the Trainer id and fname parameters before using them in SQL queries.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-4550

Affected Products

Simple Gym Management System

References · 11

• 🔥 https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Time-Based%20Blind%20SQL%20Injection%20in%20%20Simple%20Gym%20Management%20System%20in%20PHP%20Product.md · Exploit
• 🔥 https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Time-Based%20Blind%20SQL%20Injection%20in%20Simple%20Gym%20Management%20System%20in%20PHP.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4550 · Security Note
• https://twitter.com/cyberbivash/status/2035730209652023725 · Twitter Post
• https://twitter.com/CVEnew/status/2035992507683569778 · Twitter Post
• https://vuldb.com/?submit.774838 · Note
• https://vuldb.com/?id.352377 · Note
• https://code-projects.org · Note
• https://vuldb.com/?submit.774839 · Note
• https://twitter.com/VulmonFeeds/status/2035727565705412663 · Twitter Post
• https://vuldb.com/?ctiid.352377 · Note