ProjectWorlds Gym Management System version 1.0 is susceptible to an authenticated SQL injection vulnerability that could result in full database compromise.

The application is vulnerable to SQL injection via the id parameter within the profile/edit.php file. The vulnerability requires the attacker to be authenticated with low-level privileges to successfully execute arbitrary SQL commands against the backend database.

Successful exploitation of this flaw allows an authenticated attacker to execute arbitrary SQL commands, which may lead to unauthorized data access, modification, or destruction of sensitive member and system information. Given the CVSS score of 8.8, this vulnerability represents a high-severity risk that could lead to complete system compromise and significant reputational damage.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected profile/edit.php page to trusted administrative personnel only.

Proactive Monitoring: Monitor database query logs for unusual syntax, such as UNION statements or unexpected character sequences, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the id parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the researcher write-up linked in the CVE record.

The vulnerability presents a significant risk to the integrity and confidentiality of the Gym Management System. Because there is currently no vendor-provided patch, organizations must implement strict access controls and WAF filtering to mitigate the risk of unauthorized data manipulation. Continuous monitoring of application logs is essential until a formal update is released.