CVE-2025-0231
Published: 05 January 2025
Summary
CVE-2025-0231 is a medium-severity Injection (CWE-74) vulnerability in Codezips Gym Management System. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-0231 is a SQL injection vulnerability (CWE-74, CWE-89) in Codezips Gym Management System version 1.0, published on 2025-01-05. The issue resides in an unknown functionality of the file /dashboard/admin/submit_payments.php, where manipulation of the m_id argument triggers the injection. It has been classified as critical with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability enables remote exploitation by a low-privileged attacker (PR:L) with low attack complexity and no user interaction required. Successful exploitation can result in limited impacts: low confidentiality (C:L) allowing partial data disclosure, low integrity (I:L) enabling minor unauthorized modifications, and low availability (A:L) potentially causing partial denial of service.
Advisories and details are documented in references including a GitHub issue at https://github.com/gh464646/CVE/issues/1 and VulDB entries at https://vuldb.com/?ctiid.290227, https://vuldb.com/?id.290227, and https://vuldb.com/?submit.474596. The exploit has been publicly disclosed and may be used by attackers.
In notable context, the public availability of the exploit increases the risk for unpatched instances of the affected Gym Management System.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1566
Vulnerability details
A vulnerability has been found in Codezips Gym Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard/admin/submit_payments.php. The manipulation of the argument m_id leads to sql injection. The attack can…
more
be launched remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability in unauthenticated public-facing web application (/dashboard/admin/submit_payments.php) enables exploitation of public-facing application (T1190) and unauthorized database access for data collection (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and sanitization of untrusted inputs like the m_id argument in /dashboard/admin/submit_payments.php before database queries.
Mandates identification, reporting, and correction of the specific SQL injection flaw in Codezips Gym Management System 1.0 to eliminate the vulnerability.
Enforces boundary protection using web application firewalls or similar to monitor and block SQL injection payloads targeting the vulnerable endpoint remotely.