CVE-2025-1959: Codezips Gym Management System change_s_pwd.php sql injection
A vulnerability, which was classified as critical, was found in Codezips Gym Management System 1.0. Affected is an unknown function of the file /changespwd.php. The manipulation of the argument loginid/loginkey leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1959?
CVE-2025-1959 is classified as a critical severity vulnerability.
How does CVE-2025-1959 impact the Codezips Gym Management System 1.0?
CVE-2025-1959 allows for SQL injection due to improper handling of the login_id parameter in the /change_s_pwd.php file.
Who is affected by CVE-2025-1959?
Any user utilizing the Codezips Gym Management System 1.0 is vulnerable to CVE-2025-1959.
Can CVE-2025-1959 be exploited remotely?
Yes, CVE-2025-1959 can be exploited remotely, allowing attackers to execute SQL injection attacks.
How can I fix CVE-2025-1959?
To mitigate CVE-2025-1959, it is recommended to sanitize user inputs and employ prepared statements to prevent SQL injection.