Code-Projects Gym Management System SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Code-Projects Gym Management System version 1.0. The issue arises in the file '/admin/edit_exercises.php', where user-controlled input in the 'edit_exercise' parameter is not properly sanitized or parameterized before being used in SQL queries. This oversight allows for the manipulation of SQL logic, potentially leading to unauthorized data access, data tampering, or a full database compromise, depending on database permissions and the depth of exploitation.

Impact

Exploitation of this vulnerability could allow attackers to manipulate SQL queries, potentially leading to unauthorized data access, data modification, or deletion. There is also a risk of escalating the impact based on the capabilities of the SQL injection.

Reproduction

To reproduce this vulnerability, log in as an admin and navigate to '/admin/edit_exercises.php'. Once on the page, append an injectable 'edit_exercise' parameter to the URL. The injected SQL payload can then be used to exploit the SQL injection vulnerability.

Remediation

It is recommended to use prepared statements with bound parameters for all SQL queries to prevent SQL injection vulnerabilities. Additionally, input validation should be implemented to ensure that only expected data types are accepted. Applying least-privilege principles to database accounts and centralizing error handling to avoid disclosing SQL-related information can further enhance security.