A vulnerability has been found in Codezips Gym Management System 1

CVE-2025-0231 is a SQL injection in Codezips Gym Management System 1.0, specifically the admin-side file /dashboard/admin/submit_payments.php via the m_id parameter. If an attacker can reach that code path, they can likely tamper with or read member and payment records, because the bug sits in a payment-handling workflow inside the app's admin dashboard.

Vendor/CNA scoring at MEDIUM 6.3 is closer to reality than the higher NVD impact interpretation. The decisive downgrade is *real-world reachability*: this is a niche educational PHP app, default install guidance is localhost on XAMPP/WAMP, the vulnerable path lives under /dashboard/admin/, the CNA vector says PR:L, CISA ADP says Exploitation: none and Automatable: no, and EPSS is extremely low. That is not how internet-scale, fleet-priority patch emergencies behave.

Why this verdict

• Reachability is the whole story: Codezips documents this app as a localhost XAMPP/WAMP deployment, which sharply reduces real exposed population versus a normal enterprise web platform.
• Likely post-login path: the vulnerable route is /dashboard/admin/submit_payments.php, and the CNA vector is PR:L; that implies an attacker often needs an existing session or prior foothold.
• Threat intel is cold: no KEV, no confirmed active exploitation, CISA ADP says Exploitation: none and Automatable: no, and EPSS is extremely low.
• Blast radius is local to the app: even if exploited, this looks like database-level impact inside one small PHP system, not a credible fleet-wide takeover path.
• NVD's 8.8 is too theoretical: it models higher C/I/A impact, but does not change the operational truth that this is a niche admin-panel SQLi with narrow real deployment exposure.

Why not higher?

To earn MEDIUM or HIGH in an enterprise patch queue, this would need either broader exposure, confirmed exploitation, unauthenticated internet-facing reach, or a larger blast radius. Instead, the strongest evidence points to a niche app, likely authenticated access, and partial app-local impact only.

Why not lower?

It is still a real SQL injection with public exploit guidance, and if you do run this app the database can likely be read or modified. That keeps it above IGNORE: defenders should inventory it, restrict it, and plan to remove or locally fix it.

1. Restrict admin paths — Put /dashboard/admin/ behind VPN, IP allowlisting, or reverse-proxy ACLs. For a LOW verdict there is no SLA (treat as backlog hygiene), but this is the cleanest immediate risk reduction when you discover an exposed instance.
2. Block direct internet exposure — If this app is on a public interface, move it behind an internal-only listener or retire it from internet-facing use. There is no SLA (treat as backlog hygiene) for LOW, but exposed shadow-IT PHP apps should still be cleaned up during the next normal hygiene cycle.
3. Constrain DB privileges — Ensure the webapp database account has only the minimum rights needed for member/payment workflows. There is no SLA (treat as backlog hygiene) for LOW, but least privilege directly shrinks the consequence of successful SQLi.
4. Add request logging for the endpoint — Capture requests to /dashboard/admin/submit_payments.php, including source IP, method, response code, and latency. There is no SLA (treat as backlog hygiene) for LOW, but this gives you fast evidence if someone tests sqlmap or manual injection payloads.
5. Plan removal or local code fix — No vendor patch was located, so the durable answer is to retire the application, replace it, or patch the SQL handling locally with parameterized queries. There is no SLA (treat as backlog hygiene) for LOW, so schedule it as unsupported-app debt rather than emergency patching.

Run this on the target web server or on a mounted copy of its web root. Invoke it with python3 verify_cve_2025_0231.py /var/www/html or py verify_cve_2025_0231.py C:\xampp\htdocs. It needs read access to the application files; admin/root is only required if the web root is permission-restricted.

#!/usr/bin/env python3
"""
verify_cve_2025_0231.py
Detect likely presence of vulnerable Codezips Gym Management System 1.0 files.

Exit codes:
  0 = PATCHED / not present
  1 = VULNERABLE
  2 = UNKNOWN
"""
import os
import sys
from pathlib import Path

TARGET_REL = Path("dashboard") / "admin" / "submit_payments.php"
MARKERS = [
    "Gym Management System",
    "dashboard/admin",
    "submit_payments.php",
    "m_id",
]

def read_text_safe(p: Path):
    try:
        return p.read_text(encoding="utf-8", errors="ignore")
    except Exception:
        return None


def main():
    if len(sys.argv) != 2:
        print("UNKNOWN - usage: python3 verify_cve_2025_0231.py <webroot>")
        sys.exit(2)

    root = Path(sys.argv[1]).expanduser().resolve()
    if not root.exists() or not root.is_dir():
        print(f"UNKNOWN - path not found or not a directory: {root}")
        sys.exit(2)

    target = root / TARGET_REL
    if not target.exists():
        # also try a recursive find for environments where the app is nested
        matches = list(root.rglob("submit_payments.php"))
        if not matches:
            print("PATCHED - vulnerable file not found under supplied path")
            sys.exit(0)
        # if there are matches, use the first one for deeper inspection
        target = matches[0]

    content = read_text_safe(target)
    if content is None:
        print(f"UNKNOWN - found candidate file but could not read it: {target}")
        sys.exit(2)

    indicators = 0
    for marker in MARKERS:
        if marker.lower() in content.lower() or marker.lower() in str(target).lower():
            indicators += 1

    # Heuristic: if the exact admin file exists in a gym-management style tree,
    # and references the m_id parameter, assume vulnerable because no fixed
    # vendor version is known from public references.
    has_mid = "m_id" in content
    has_php_superglobals = ("$_POST" in content) or ("$_GET" in content) or ("$_REQUEST" in content)
    likely_app = any(x in str(target).replace('\\', '/').lower() for x in ["dashboard/admin/submit_payments.php", "gym", "member", "payment"])

    if target.name == "submit_payments.php" and likely_app and (has_mid or indicators >= 2):
        print(f"VULNERABLE - found likely Codezips Gym Management System payment handler: {target}")
        sys.exit(1)

    if target.name == "submit_payments.php" and has_php_superglobals:
        print(f"UNKNOWN - candidate payment handler found but identity not conclusive: {target}")
        sys.exit(2)

    print("PATCHED - supplied path does not appear to contain the known vulnerable app file")
    sys.exit(0)

if __name__ == "__main__":
    main()

Sources

1. NVD CVE-2025-0231
2. OpenCVE record for CVE-2025-0231
3. Public PoC / advisory issue on GitHub
4. Codezips Gym Management System project page
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS project
7. OpenCVE product view for Codezips Gym Management System CVEs