CVE-2026-55871: GYM One SQL Injection Vulnerability

CVE-2026-55871 Overview

CVE-2026-55871 is a SQL injection vulnerability in GYM One, an open-source gym management application used by fitness centers, personal trainers, and sports clubs. The flaw exists in admin/users/index.php, which concatenates the search_name and search_email GET parameters directly into both the user-list query and the pagination COUNT query without using prepared statements. An authenticated administrator can inject SQL through either search parameter to read data from arbitrary tables, including user records and password hashes. Depending on database privileges, the same vector may also allow writing to the filesystem. The issue is tracked under [CWE-89] and is fixed in version 1.4.1.

Critical Impact
Authenticated administrators can extract password hashes, enumerate arbitrary database tables, and potentially achieve filesystem writes through SQL injection in admin search parameters.

Affected Products

GYM One versions prior to 1.4.1
admin/users/index.php user search functionality
Deployments where the MySQL/MariaDB account has FILE privileges (secondary impact)

Discovery Timeline

2026-10-15 - CVE-2026-55871 published to the National Vulnerability Database (NVD)
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-55871

Vulnerability Analysis

The vulnerability is a classic in-band SQL injection reachable through authenticated administrator sessions. GYM One's user administration page accepts search_name and search_email as HTTP GET parameters and interpolates them directly into two SQL statements: the primary SELECT that renders the user list and the COUNT query that drives pagination. Because neither statement uses parameter binding, attacker-controlled input is parsed by the database engine as SQL syntax.

Exploitation permits boolean-based, UNION-based, and error-based extraction techniques against any table the database user can read, including credential tables that store password hashes. Where the database account has FILE privileges, the injection can be escalated to write files to disk via SELECT ... INTO OUTFILE, which may be chained to deploy a PHP webshell within the web root.

Root Cause

The root cause is unsanitized concatenation of user input into SQL strings. The application does not apply prepared statements, parameter binding, or allowlist filtering before composing queries from $_GET['search_name'] and $_GET['search_email'].

Attack Vector

An authenticated administrator issues a crafted GET request to admin/users/index.php with SQL payloads in search_name or search_email. The exploit requires a valid admin session, which limits exposure to insiders, attackers with harvested admin credentials, or chained attacks that first compromise an administrator account.

php

// Vendor patch sample from v1.4.1 — migration from string concatenation to
// prepared statements for a sibling query (admin/boss/chroom/index.php)
$szekreny_szam = $_POST['szekreny_szam'];
$oltozo = $_POST['oltozo'];

// Vulnerable pattern (pre-1.4.1)
// $sql = "INSERT INTO lockers (lockernum, gender) VALUES ('$szekreny_szam', '$oltozo')";
// $conn->query($sql);

// Fixed pattern (1.4.1)
$sql = "INSERT INTO lockers (lockernum, gender) VALUES (?, ?)";
$stmt = $conn->prepare($sql);
$stmt->bind_param("ss", $szekreny_szam, $oltozo);
$stmt->execute();

Source: GitHub Commit d3a0cf1

Detection Methods for CVE-2026-55871

Indicators of Compromise

Web server access logs containing SQL metacharacters in search_name or search_email query parameters, such as UNION SELECT, SLEEP(, INFORMATION_SCHEMA, 0x, or stacked semicolons.
Unexpected files written under the web root (for example, new .php files in admin directories) that could indicate INTO OUTFILE abuse.
MySQL/MariaDB error log entries referencing malformed queries originating from admin/users/index.php.

Detection Strategies

Deploy a web application firewall rule that inspects GET parameters sent to admin/users/index.php for SQL injection signatures and anomalous payload length.
Enable MySQL general query logging in staging and audit queries originating from the admin user management page for UNION, SELECT ... FROM mysql., or INTO OUTFILE patterns.
Review PHP error logs for syntax errors emitted from the vulnerable query site, which often indicate injection attempts.

Monitoring Recommendations

Alert on administrator account logins from new geolocations or IP ranges, since exploitation requires an authenticated admin session.
Monitor file integrity of the admin/ and web-root directories for unauthorized file creation or modification.
Track outbound database connections and large SELECT result sets that could indicate bulk credential extraction.

How to Mitigate CVE-2026-55871

Immediate Actions Required

Upgrade GYM One to version 1.4.1 or later, which replaces the vulnerable concatenation with prepared statements.
Rotate all administrator passwords and invalidate active admin sessions after patching.
Audit the users table and any secrets storage for signs of extraction, and force password resets if compromise is suspected.
Revoke FILE privilege from the application's database account to blunt filesystem-write escalation.

Patch Information

The fix is delivered in GYM One v1.4.1. Full technical details are published in the GitHub Security Advisory GHSA-9j4g-cq35-8997, with the code change available in commit d3a0cf1.

Workarounds

Restrict access to admin/users/index.php through network-layer controls such as IP allowlisting or VPN-only administration.
Deploy a WAF rule that blocks SQL metacharacters in the search_name and search_email parameters until the upgrade is applied.
Grant the GYM One database account only the minimum privileges required (no FILE, no cross-database access) to limit injection impact.

bash

# Example MySQL hardening: remove FILE privilege and restrict schema access
REVOKE FILE ON *.* FROM 'gymone'@'localhost';
REVOKE ALL PRIVILEGES ON *.* FROM 'gymone'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON gymone_db.* TO 'gymone'@'localhost';
FLUSH PRIVILEGES;