CodeZips Gym Management System SQL Injection Vulnerability

A critical SQL injection vulnerability has been identified in CodeZips Gym Management System version 1.0. The issue resides in the file '/dashboard/admin/more-userprofile.php', specifically within the 'login_id' parameter. This vulnerability allows remote attackers to inject arbitrary SQL commands, potentially leading to unauthorized database access, data manipulation, and full system compromise. The vulnerability does not require authentication to exploit.

Impact

Exploitation of this vulnerability could result in a database compromise, allowing attackers to read, modify, or delete data. There is also a risk of data leakage, as sensitive customer or payment information could be exposed. Additionally, malicious SQL queries could degrade application performance or cause it to crash.