Executive brief
A security vulnerability exists in the Simple Gym Management System, a software tool used to manage gym memberships and payments. An attacker can exploit this flaw to manipulate payment records, potentially altering transaction amounts or accessing sensitive customer information. This could lead to financial discrepancies and unauthorized access to business data.
Technical details
A SQL injection vulnerability exists in the 'func.php' file of code-projects Simple Gym Management System 1.0 within the Payment Handler component. The application fails to sanitize or parameterize several inputs, including Payment_id, Amount, customer_id, payment_type, and customer_name, before concatenating them into an INSERT SQL statement. A remote attacker with low privileges can exploit this by sending crafted payment data to manipulate the database. This can result in the creation of fraudulent payment records, modification of existing data, or extraction of sensitive information from the database. A public Proof of Concept (PoC) has been disclosed.
Affected products
- code-projects Simple Gym Management System 1.0
Timeline
- 2026-03-15: disclosed: Initial disclosure on GitHub issues
- 2026-03-31: advisory: NVD and VulDB publication