CVE-2026-4550 Details
Description
A vulnerability has been found in code-projects Simple Gym Management System up to 1.0. This affects an unknown part of the file /gym/func.php. Such manipulation of the argument Trainer_id/fname leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
A time-based blind SQL injection vulnerability has been identified in Code-Projects Simple Gym Management System in PHP, specifically in version 1.0. The issue arises in the Trainer_id parameter of the /gym/func.php file, where user input is not properly validated or sanitized before being included in SQL queries. This vulnerability can be exploited remotely, allowing attackers to inject malicious SQL payloads that are executed by the backend database. The exploitation of this vulnerability could lead to unauthorized database access, allowing attackers to extract, modify, or delete sensitive information.
Developers are advised to implement input validation and sanitization, use prepared statements for database queries, and ensure that the application follows the principle of least privilege when accessing the database.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 22, 2026CISA-ADP
Assessed Mar 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Time-Based%20Blind%20SQL%20Injection%20in%20%20Simple%20Gym%20Management%20System%20in%20PHP%20Product.md | CISA-ADP | ExploitTechnical Description |
| https://code-projects.org/ | [email protected] | |
| https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Time-Based%20Blind%20SQL%20Injection%20in%20%20Simple%20Gym%20Management%20System%20in%20PHP%20Product.md | [email protected] | ExploitTechnical Description |
| https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Time-Based%20Blind%20SQL%20Injection%20in%20Simple%20Gym%20Management%20System%20in%20PHP.md | [email protected] | ExploitTechnical Description |
| https://vuldb.com/?ctiid.352377 | [email protected] | Content Wall |
| https://vuldb.com/?id.352377 | [email protected] | AdvisoryExploit |
| https://vuldb.com/?submit.774838 | [email protected] | Technical Description |
| https://vuldb.com/?submit.774839 | [email protected] | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Code-Projects Simple Gym Management System | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Mar 23, 2026 | CVE Modified | CISA-ADP |
| Mar 22, 2026 | New CVE Received | [email protected] |