CVE-2025-67146
Published
CVSS v3
9.4
CRITICAL
CVSS v2
N/A
Affected
1
PROJECT
Description
Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, (2) trainer_search.php, and (3) gym_search.php, and via the 'id' parameter in (4) payment_search.php. An unauthenticated remote attacker can exploit these issues to inject malicious SQL commands, leading to unauthorized data extraction, authentication bypass, or modification of database contents.
Gym Management System is an administrative interface for the records of gym, gym members, gym trainers and payments.
GitHub