CVE-2025-12609
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A vulnerability was found in CodeAstro Gym Management System 1.0 in the file /admin/update-progress.php. Manipulation of the id/ini_weight argument leads to SQL injection. The attack can be launched remotely, and the exploit has been made public and could be used.
Risk Assessment
A remote attacker could execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion. The public availability of the exploit increases the risk of rapid exploitation.
Recommendation
Update CodeAstro Gym Management System to a patched version as soon as possible, or apply mitigations such as input validation and restricting access to /admin/update-progress.php. Consider deploying a WAF to block SQL injection attempts.
Other vulnerabilities in CodeAstro Gym Management System
See all- CVE-2025-13172Medium
A security flaw has been discovered in CodeAstro Gym Management System 1.0. An unknown function in /admin/view-member-report.php is affected. Manipulation of the ID argument results in SQL injection. The attack can be initiated remotely and the exploit has been released.
- CVE-2025-12261Medium
A SQL injection vulnerability was found in CodeAstro Gym Management System 1.0 in the file /admin/actions/remove-announcement.php. Manipulation of the argument ID allows remote attack. The exploit has been made public and could be used.
- CVE-2025-11593Medium
A SQL injection vulnerability was found in CodeAstro Gym Management System 1.0 in the file /admin/actions/delete-equipment.php. Manipulation of the ID argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been published and may be used.
- CVE-2025-11591Medium
A SQL injection vulnerability was detected in CodeAstro Gym Management System 1.0 in the file /admin/actions/delete-member.php. Manipulation of the ID argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been publicly disclosed and may be used.
- CVE-2025-11590Medium
A SQL injection vulnerability was identified in CodeAstro Gym Management System 1.0 in the file /admin/equipment-entry.php. Manipulation of the ename argument leads to SQL injection, and the attack can be launched remotely. The exploit has been made publicly available and could be used.
- CVE-2025-11588Medium
A SQL injection vulnerability was identified in CodeAstro Gym Management System 1.0 in the file /customer/index.php. Manipulation of the fullname argument leads to SQL injection, and the attack can be performed remotely. The exploit is publicly available and might be used.
Original NVD description (English source)
A vulnerability was found in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/update-progress.php. Performing a manipulation of the argument id/ini_weight results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS