CVE-2025-67146: Gym Management System SQLi Vulnerability

CVE-2025-67146 Overview

CVE-2025-67146 documents multiple SQL Injection vulnerabilities in AbhishekMali21 GYM-MANAGEMENT-SYSTEM version 1.0. The flaws affect the name parameter in member_search.php, trainer_search.php, and gym_search.php, and the id parameter in payment_search.php. An unauthenticated remote attacker can inject arbitrary SQL through these endpoints. Successful exploitation enables data extraction, authentication bypass, and modification of database records. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can extract, modify, or destroy database contents and bypass authentication through four distinct injection points.

Affected Products

AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0
member_search.php, trainer_search.php, gym_search.php (vulnerable name parameter)
payment_search.php (vulnerable id parameter)

Discovery Timeline

2026-01-12 - CVE-2025-67146 published to NVD
2026-01-27 - Last updated in NVD database

Technical Details for CVE-2025-67146

Vulnerability Analysis

The GYM-MANAGEMENT-SYSTEM application passes user-supplied search parameters directly into SQL queries without sanitization or parameterization. Four PHP search endpoints concatenate request input into query strings executed against the backend database. Because the affected endpoints accept requests without authentication, any network-reachable attacker can issue crafted requests. Each injection point is reachable through standard HTTP GET or POST requests, requiring no user interaction.

The impact spans the full classic SQL injection threat model. Attackers can perform UNION-based data exfiltration to dump member records, trainer details, and payment information. Boolean-based and time-based blind techniques work where output is suppressed. The flaw also enables authentication bypass when injected payloads alter login logic that relies on the same vulnerable database layer.

Root Cause

The application constructs SQL statements using string concatenation with unsanitized request parameters. PHP code accepts the name and id values from client requests and embeds them directly into SELECT queries. The application uses neither prepared statements with bound parameters nor input validation routines. This pattern violates standard secure coding practices for database access in PHP.

Attack Vector

An attacker sends an HTTP request to one of the four vulnerable endpoints with a crafted parameter value. For example, a request to member_search.php?name=' OR 1=1-- would return all member rows. Time-based payloads using SLEEP() or BENCHMARK() confirm blind injection. UNION-based payloads extract data from arbitrary tables, including credential stores. No authentication, privileges, or user interaction are required.

For technical detail on the affected code paths, see the GitHub Issue Discussion.

Detection Methods for CVE-2025-67146

Indicators of Compromise

HTTP requests to member_search.php, trainer_search.php, gym_search.php, or payment_search.php containing SQL syntax such as UNION SELECT, OR 1=1, SLEEP(, or -- comment markers.
Web server access logs showing repeated requests to the four search endpoints with abnormal parameter lengths or encoded payloads.
Database error messages or stack traces returned to clients indicating malformed SQL execution.
Unexpected reads from authentication or payment tables outside normal application flow.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set to alert on SQL injection signatures targeting the four named PHP files.
Enable database query logging and alert on queries containing tautologies, UNION operators, or comment sequences from application service accounts.
Correlate web access logs with database audit logs to identify request-to-query patterns indicative of injection.

Monitoring Recommendations

Monitor outbound data volume from the database server for spikes consistent with bulk extraction.
Track failed login events alongside requests to search endpoints to identify authentication bypass attempts.
Review file integrity on the web application directory to detect attacker-uploaded shells or webshell drops following exploitation.

How to Mitigate CVE-2025-67146

Immediate Actions Required

Remove the application from public network exposure until a patched build or code fix is deployed.
Restrict access to the four vulnerable endpoints at the reverse proxy or WAF layer.
Audit the database account used by the application and revoke any privileges not required for runtime operation.
Review web and database logs for prior exploitation attempts dating back to the application deployment.

Patch Information

No vendor-issued security patch has been published. AbhishekMali21 GYM-MANAGEMENT-SYSTEM is an open-source project, and remediation requires source-level changes. Operators should refactor member_search.php, trainer_search.php, gym_search.php, and payment_search.php to use PDO or mysqli prepared statements with bound parameters. Apply server-side input validation to enforce expected types and character sets.

Workarounds

Place the application behind a WAF with SQL injection rule sets enabled in blocking mode.
Implement a reverse-proxy filter that rejects requests where name or id parameters contain SQL metacharacters such as quotes, semicolons, or comment markers.
Run the database service under a least-privilege account that cannot modify schema, write files, or access tables outside the application scope.
Disable the four vulnerable endpoints in the web server configuration if the search functionality is non-essential.

bash

# Example nginx location block to deny access to vulnerable endpoints
location ~* /(member_search|trainer_search|gym_search|payment_search)\.php$ {
    deny all;
    return 403;
}