CVE-2025-67146: GYM-MANAGEMENT-SYSTEM SQLi Vulnerability

CVE-2025-67146 Overview

Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the name parameter in member_search.php, trainer_search.php, and gym_search.php, and via the id parameter in payment_search.php. An unauthenticated remote attacker can exploit these issues to inject malicious SQL commands, leading to unauthorized data extraction, authentication bypass, or modification of database contents.

Critical Impact

Unauthenticated attackers can exploit multiple SQL injection entry points to extract sensitive member data, bypass authentication mechanisms, or modify database contents including payment records and user credentials.

Affected Products

• AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0
• member_search.php - vulnerable name parameter
• trainer_search.php - vulnerable name parameter
• gym_search.php - vulnerable name parameter
• payment_search.php - vulnerable id parameter

Discovery Timeline

• 2026-01-12 - CVE-2025-67146 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-67146

Vulnerability Analysis

This vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The GYM-MANAGEMENT-SYSTEM application fails to properly sanitize user-supplied input before incorporating it into SQL queries across multiple search functionality endpoints.

The vulnerability affects four distinct PHP files that handle search operations within the gym management platform. The name parameter in three search files (member_search.php, trainer_search.php, and gym_search.php) and the id parameter in payment_search.php all accept user input without adequate validation or parameterization. This allows attackers to craft malicious input that alters the intended SQL query logic.

Because no authentication is required to access these endpoints, the attack surface is significantly broader, enabling any remote attacker with network access to exploit these flaws. Successful exploitation can lead to complete database compromise, including extraction of sensitive personal information, financial records, and administrative credentials.

Root Cause

The root cause of this vulnerability is the direct concatenation of user-supplied input into SQL query strings without proper sanitization, escaping, or use of prepared statements with parameterized queries. The application developers failed to implement input validation controls or use secure coding practices when handling the name and id parameters in the search functionality.

PHP applications using MySQL databases should utilize PDO (PHP Data Objects) or MySQLi with prepared statements to prevent SQL injection. The affected codebase appears to construct queries by directly embedding user input, making it trivial for attackers to manipulate query behavior.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can craft HTTP requests containing malicious SQL payloads targeting any of the four vulnerable search endpoints. The vulnerability can be exploited through standard web requests.

For example, an attacker could submit a crafted search request to member_search.php with a name parameter containing SQL metacharacters and injection payloads. The lack of input sanitization allows these characters to be interpreted as SQL commands rather than literal search terms.

Common exploitation techniques include UNION-based injection to extract data from other tables, boolean-based blind injection to enumerate database contents character by character, and time-based blind injection when error messages are suppressed. The payment_search.php endpoint is particularly concerning as it handles financial data and uses a numeric id parameter, which may bypass basic string-based filtering if implemented.

Detection Methods for CVE-2025-67146

Indicators of Compromise

• Web server access logs containing SQL metacharacters (single quotes, double dashes, UNION, SELECT, OR 1=1) in requests to member_search.php, trainer_search.php, gym_search.php, or payment_search.php
• Database query logs showing malformed or unexpected SQL queries originating from the search endpoints
• Unusual database access patterns such as queries returning large datasets or accessing tables unrelated to search functionality
• Error logs containing SQL syntax errors or database connection issues following search requests

Detection Strategies

• Deploy a Web Application Firewall (WAF) configured with SQL injection detection rules specifically monitoring the vulnerable endpoints
• Implement application-level logging to capture all parameters submitted to search endpoints and flag suspicious patterns
• Configure database activity monitoring to alert on queries containing UNION statements, information_schema access, or attempts to read sensitive tables
• Use SentinelOne Singularity XDR to correlate network traffic anomalies with endpoint behavior indicating post-exploitation activity

Monitoring Recommendations

• Enable verbose logging on the web server and database server to capture detailed request and query information
• Set up real-time alerting for any requests to the four vulnerable PHP files containing common SQL injection patterns
• Monitor for unexpected outbound data transfers that could indicate successful data exfiltration
• Establish baseline metrics for search endpoint usage to detect anomalous request volumes or patterns

How to Mitigate CVE-2025-67146

Immediate Actions Required

• Restrict access to member_search.php, trainer_search.php, gym_search.php, and payment_search.php via web server configuration until patches are applied
• Implement WAF rules to block requests containing SQL injection payloads to the vulnerable endpoints
• Review database accounts used by the application and ensure they have minimal required privileges
• Audit database logs for any evidence of prior exploitation attempts

Patch Information

No official patch is currently available from the vendor. The vulnerability was disclosed via a GitHub Issue Discussion in the project repository. Organizations using this software should monitor the repository for updates or implement manual code fixes using prepared statements.

To remediate this vulnerability, developers should refactor all affected search functions to use parameterized queries via PDO or MySQLi prepared statements. This ensures user input is treated as data rather than executable SQL code, effectively neutralizing injection attacks.

Workarounds

• Disable or remove the affected search functionality until secure implementations are available
• Place the application behind a reverse proxy with strict input validation rules for the name and id parameters
• Implement server-side input validation to reject requests containing SQL metacharacters (though this is not a complete fix)
• Consider migrating to an alternative gym management solution that follows secure coding practices

# Apache .htaccess configuration to restrict access to vulnerable files
<FilesMatch "(member_search|trainer_search|gym_search|payment_search)\.php$">
    Order Deny,Allow
    Deny from all
    # Allow only from trusted admin IPs if needed
    # Allow from 192.168.1.0/24
</FilesMatch>