Exploitation Summary
EIP tracks 1 public exploit for CVE-2025-67147. PoCs published by sivaadityacoder.
AI-analyzed exploit summary The repository contains functional PHP exploit code demonstrating SQL injection vulnerabilities in a gym management system. The code shows direct user input concatenation into SQL queries without proper sanitization, enabling SQLi attacks.
Description
Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' parameters in (1) submit_contact.php, the 'username' and 'pass_key' parameters in (2) secure_login.php, and the 'login_id', 'pwfield', and 'login_key' parameters in (3) change_s_pwd.php. An unauthenticated or authenticated attacker can exploit these issues to bypass authentication, execute arbitrary SQL commands, modify database records, delete data, or escalate privileges to administrator level.
Exploits (1)
The repository contains functional PHP exploit code demonstrating SQL injection vulnerabilities in a gym management system. The code shows direct user input concatenation into SQL queries without proper sanitization, enabling SQLi attacks.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H