CVE-2025-67147: Gym Management System PHP SQLi Flaw

CVE-2025-67147 Overview

Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the name, email, and comment parameters in submit_contact.php, the username and pass_key parameters in secure_login.php, and the login_id, pwfield, and login_key parameters in change_s_pwd.php. An unauthenticated or authenticated attacker can exploit these issues to bypass authentication, execute arbitrary SQL commands, modify database records, delete data, or escalate privileges to administrator level.

Critical Impact

These SQL injection flaws allow unauthenticated attackers to completely compromise the application's database, bypass authentication mechanisms, and gain administrative access to the gym management system.

Affected Products

• Gym-Management-System-PHP version 1.0
• submit_contact.php endpoint
• secure_login.php endpoint
• change_s_pwd.php endpoint

Discovery Timeline

• 2026-01-12 - CVE CVE-2025-67147 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-67147

Vulnerability Analysis

This vulnerability is classified as SQL Injection (CWE-89), which occurs when user-supplied input is incorporated into SQL queries without proper sanitization or parameterization. The Gym-Management-System-PHP application fails to validate or sanitize multiple input parameters across three distinct PHP files, creating numerous injection points that attackers can exploit.

The vulnerable endpoints handle critical functionality including user authentication (secure_login.php), password management (change_s_pwd.php), and contact form submissions (submit_contact.php). The widespread nature of these flaws across authentication-related files makes this vulnerability particularly dangerous, as it enables complete authentication bypass.

Root Cause

The root cause stems from improper input validation and the likely use of dynamic SQL query construction without parameterized queries or prepared statements. The application directly concatenates user-supplied input from HTTP request parameters into SQL queries, allowing attackers to inject malicious SQL syntax that alters the intended query logic.

Parameters such as username, pass_key, login_id, pwfield, login_key, name, email, and comment are all passed directly to database queries without sanitization, escaping, or the use of parameterized statements that would prevent SQL injection attacks.

Attack Vector

The attack vector is network-based, requiring no authentication and no user interaction. An attacker can craft malicious HTTP requests targeting any of the three vulnerable endpoints. By injecting SQL syntax into the vulnerable parameters, attackers can:

• Bypass authentication by injecting tautologies (e.g., ' OR '1'='1) into login fields
• Extract sensitive data from the database using UNION-based or error-based injection techniques
• Modify or delete database records through UPDATE or DELETE statement injection
• Escalate privileges by manipulating user roles or creating administrator accounts
• Potentially execute operating system commands if database features like xp_cmdshell (MSSQL) or LOAD_FILE/INTO OUTFILE (MySQL) are enabled

The vulnerability in secure_login.php is particularly critical as it allows complete authentication bypass, granting attackers immediate access to the application without valid credentials.

Detection Methods for CVE-2025-67147

Indicators of Compromise

• Unusual SQL error messages in application logs or web server access logs
• HTTP requests to submit_contact.php, secure_login.php, or change_s_pwd.php containing SQL keywords such as UNION, SELECT, INSERT, UPDATE, DELETE, DROP, or comment sequences (--, /*)
• Abnormal database query patterns including error-based or time-based injection attempts
• Unexpected administrative account creation or privilege modifications in the application

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in request parameters targeting the vulnerable endpoints
• Monitor application and database logs for SQL syntax errors, especially those revealing database structure information
• Deploy intrusion detection systems (IDS) with signatures for common SQL injection payloads
• Enable database audit logging to track unusual query patterns or unauthorized data access attempts

Monitoring Recommendations

• Set up alerts for HTTP requests containing SQL metacharacters or keywords in the name, email, comment, username, pass_key, login_id, pwfield, and login_key parameters
• Monitor for failed authentication attempts followed by successful logins, which may indicate authentication bypass exploitation
• Track database query execution times to detect time-based blind SQL injection attempts
• Implement anomaly detection for unusual data exfiltration patterns from the database

How to Mitigate CVE-2025-67147

Immediate Actions Required

• Restrict network access to the Gym-Management-System-PHP application to trusted IP ranges only
• Deploy a Web Application Firewall (WAF) with SQL injection protection rules in front of the application
• Disable the application temporarily if it handles sensitive data and cannot be immediately patched
• Review database logs and user accounts for evidence of compromise or unauthorized modifications

Patch Information

No official vendor patch has been released at this time. Users should monitor the GitHub Issue Discussion for updates from the developer regarding security fixes. Given the critical nature of these vulnerabilities, organizations should consider implementing manual code fixes or migrating to a more secure gym management solution.

Workarounds

• Implement input validation and sanitization on all affected parameters by modifying the PHP source code to use prepared statements with parameterized queries (PDO or MySQLi)
• Deploy a reverse proxy with ModSecurity or similar WAF capability configured to block SQL injection attempts
• Restrict database user privileges to the minimum required for application functionality, preventing destructive operations like DROP or file system access
• Enable PHP's mysqli_real_escape_string() as a temporary measure, though parameterized queries are strongly preferred

The most effective remediation is to refactor the vulnerable PHP files to use prepared statements with bound parameters. For example, replace direct query concatenation with PDO prepared statements:

# Recommended: Use prepared statements instead of string concatenation
# Replace vulnerable query patterns like:
#   $query = "SELECT * FROM users WHERE username = '$username'";
# With parameterized queries using PDO or MySQLi prepared statements
# See PHP documentation for mysqli_prepare() or PDO::prepare()