CVE-2025-12242
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability has been found in CodeAstro Gym Management System 1.0. The file /admin/actions/check-attendance.php is affected. Manipulation of the argument ID leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed to the public.
Risk Assessment
The risk includes the possibility of unauthorized database access, data theft, or modification, which may compromise system integrity.
Recommendation
Immediately apply patches, validate input data, and use parameterized queries.
Other vulnerabilities in Gym Management System
See all- CVE-2025-67146Critical
Multiple SQL Injection vulnerabilities in GYM-MANAGEMENT-SYSTEM 1.0 by AbhishekMali21, in 'name' and 'id' parameters in various scripts. An unauthenticated attacker can inject malicious SQL commands, leading to unauthorized data extraction, authentication bypass, or database modification.
- CVE-2025-11592Medium
A SQL injection vulnerability was detected in Gym Management System 1.0 in /admin/edit-equipmentform.php. Manipulation of the ID argument allows remote SQL injection. The exploit is public.
- CVE-2025-11589Medium
A SQL injection vulnerability was discovered in Gym Management System 1.0 in /admin/user-payment.php. Manipulation of the plan argument allows remote SQL injection. The exploit is public.
Original NVD description (English source)
A vulnerability has been found in CodeAstro Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/actions/check-attendance.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS