CVE-2025-11591: Codeastro Gym Management System SQLi

CVE-2025-11591 Overview

CVE-2025-11591 is a SQL injection vulnerability in CodeAstro Gym Management System 1.0. The flaw resides in the /admin/actions/delete-member.php script, where the ID parameter is passed to a database query without proper sanitization. Attackers with low-privileged authenticated access can manipulate the ID argument to inject arbitrary SQL statements. The vulnerability is exploitable remotely over the network and has been publicly disclosed. The issue is tracked under [CWE-89] (SQL Injection) and [CWE-74] (Improper Neutralization of Special Elements in Output).

Critical Impact
Authenticated attackers can inject SQL commands through the ID parameter of the member deletion endpoint, potentially leading to unauthorized data access, modification, or deletion within the gym management database.

Affected Products

CodeAstro Gym Management System 1.0
CPE: cpe:2.3:a:codeastro:gym_management_system:1.0
Component: /admin/actions/delete-member.php

Discovery Timeline

2025-10-11 - CVE-2025-11591 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11591

Vulnerability Analysis

The vulnerability exists in the administrative member deletion workflow of the Gym Management System. The delete-member.php script accepts an ID parameter from the request and concatenates it directly into a SQL DELETE statement without parameterization or input validation. This classic string concatenation pattern allows an attacker to append arbitrary SQL syntax to the query. Exploitation requires authentication with administrative panel access, which limits the attacker population but does not prevent malicious insider or credential-compromise scenarios. The disclosed proof-of-concept confirms the injection is reachable through standard HTTP requests to the admin endpoint.

Root Cause

The root cause is the failure to use parameterized queries or prepared statements when constructing the DELETE SQL query in delete-member.php. User-controlled input from the ID parameter is treated as trusted SQL syntax rather than as a data value. No input filtering, type casting to integer, or use of PDO/MySQLi prepared statements is present. This maps directly to [CWE-89] and the broader injection weakness class [CWE-74].

Attack Vector

The attack vector is network-based and requires low privileges. An authenticated attacker sends a crafted HTTP request to /admin/actions/delete-member.php with a malicious payload in the ID parameter. The payload can include SQL metacharacters such as single quotes, UNION operators, or stacked query terminators to alter query logic. Successful exploitation may result in data extraction through boolean-based or UNION-based techniques, unauthorized deletion of records, or manipulation of authentication data. See the GitHub CVE Issue #4 and VulDB entry #327912 for public proof-of-concept details.

No verified exploit code is reproduced here. Refer to the linked advisories for the full technical proof-of-concept.

Detection Methods for CVE-2025-11591

Indicators of Compromise

HTTP requests to /admin/actions/delete-member.php containing SQL metacharacters such as ', ", --, ;, UNION, or SLEEP( in the ID parameter.
Unusually long or URL-encoded values submitted to the ID parameter of the member deletion endpoint.
Unexpected DELETE or SELECT queries in MySQL query logs originating from the gym management application user.
Sudden loss of member records or unauthorized modifications to administrative accounts.

Detection Strategies

Deploy a web application firewall rule that inspects the ID parameter for non-numeric characters and blocks requests containing SQL syntax tokens.
Enable MySQL general query logging temporarily to correlate application requests against generated SQL statements for the affected endpoint.
Review web server access logs for repeated POST or GET requests to delete-member.php from a single session or IP address.

Monitoring Recommendations

Monitor administrative session activity for anomalous deletion patterns or high-volume requests to member management endpoints.
Alert on database errors such as You have an error in your SQL syntax appearing in application logs, which indicate probing activity.
Track authentication events for the admin panel and correlate with subsequent requests to sensitive action scripts.

How to Mitigate CVE-2025-11591

Immediate Actions Required

Restrict access to the /admin/ directory using IP allow-listing or additional HTTP authentication until a code-level fix is applied.
Audit administrative accounts and rotate credentials for any account with access to the gym management admin panel.
Back up the gym management database and review recent DELETE operations for signs of exploitation.

Patch Information

At the time of publication, no official vendor patch has been referenced in the NVD entry or on the CodeAstro website. Organizations using Gym Management System 1.0 should contact the vendor for remediation guidance or apply the source-code fixes described below. Additional context is available at VulDB CTIID #327912.

Workarounds

Modify delete-member.php to cast the ID parameter to an integer using intval() before use in any SQL query.
Replace string-concatenated SQL with prepared statements using PDO or MySQLi with bound parameters.
Enforce least-privilege database accounts so the web application user cannot execute schema changes or access unrelated tables.
Deploy a web application firewall with SQL injection signatures in front of the application as a compensating control.

bash

# Example WAF-style ModSecurity rule to block SQL metacharacters in the ID parameter
SecRule ARGS:ID "!@rx ^[0-9]+$" \
    "id:1005911,\
    phase:2,\
    deny,\
    status:403,\
    msg:'Non-numeric ID parameter to delete-member.php - possible SQLi (CVE-2025-11591)',\
    tag:'CWE-89'"