CVE-2025-10851

Vulnerability

Description A security flaw exists in Campcodes Gym Management System version 1.0. The file /ajax.php?action=login is vulnerable to SQL injection through the manipulation of the Username argument. This allows an attacker to inject malicious SQL queries into the backend database [1].

Exploitation

The attack can be performed remotely without authentication. An attacker can send a crafted HTTP request to the login endpoint, injecting SQL commands via the Username parameter. The exploit has been publicly released, increasing the likelihood of active exploitation [1].

Impact

Successful exploitation could lead to unauthorized access to sensitive data stored in the database, such as user credentials or personal information. The attacker may also be able to modify or delete data, potentially compromising the entire system [1].

Mitigation

As of the publication date, no official patch has been announced by Campcodes. Users are advised to implement input sanitization and parameterized queries to mitigate the risk. Given the public availability of exploit code, immediate action is recommended [1].