CVE-2026-5206

Vulnerability

Description

A SQL injection vulnerability exists in code-projects Simple Gym Management System 1.0, specifically in the /func.php file's payment handler. The application directly concatenates user-supplied values for Payment_id, Amount, customer_id, payment_type, and customer_name into an INSERT SQL statement without any sanitization or parameterization [1].

Exploitability

The attack is exploitable remotely via crafted HTTP POST requests to the payment functionality. No authentication is required. The publicly disclosed proof-of-concept demonstrates setting Payment_id to ' OR '1'='1, which breaks out of the SQL string and alters the query logic [1].

Impact

An attacker can manipulate payment records—altering amounts, forging payments, or deleting entries—leading to financial loss and data integrity compromise. The injection may also allow extraction of sensitive information from the database [1].

Mitigation

No official patch has been released by the vendor. Users should mitigate by implementing prepared statements (PDO or MySQLi) and validating input types and lengths. Until a fix is applied, the system remains vulnerable to exploitation.