CVE-2025-67146

Name of the Vulnerable Software and Affected Versions AbhishekMali21 GYM-MANAGEMENT-SYSTEM version 1.0

Description The application contains multiple SQL Injection flaws. These issues are present via the name parameter in the member search.php, trainer search.php, and gym search.php files, and via the id parameter in the payment search.php file. A remote attacker who does not need to be authenticated can inject malicious SQL commands. Successful exploitation could lead to unauthorized data extraction, authentication bypass, or modification of database contents.

Recommendations Apply input validation and sanitization to the name parameter in member search.php. Apply input validation and sanitization to the name parameter in trainer search.php. Apply input validation and sanitization to the name parameter in gym search.php. Apply input validation and sanitization to the id parameter in payment search.php.