An unauthenticated SQL injection vulnerability in Campcodes Gym Management System 1.0 poses a significant risk of unauthorized data access and potential system compromise.

This vulnerability is a SQL injection (CWE-89) flaw located in the /ajax.php endpoint. An unauthenticated attacker can supply malicious input to the Username parameter to execute arbitrary SQL commands against the backend database.

The ability for an unauthenticated user to interact directly with the database poses a severe threat to data confidentiality and integrity. With a CVSS score of 7.3, this high-severity flaw could lead to the unauthorized exfiltration of user credentials or sensitive gym member information, potentially resulting in regulatory non-compliance and reputational damage.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the application or disable the affected login functionality if possible.

Proactive Monitoring: Monitor database query logs for unusual syntax patterns, such as UNION or SLEEP commands, and review web server access logs for repeated requests to the ajax.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the Username parameter.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the reference documentation.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations utilizing Campcodes Gym Management System 1.0 must prioritize the implementation of compensating controls, such as WAF filtering, while maintaining close contact with the vendor for an official security update.