A remote SQL injection vulnerability exists in the code-projects Simple Gym Management System, affecting the /gym/func.php file in versions up to 1.0. By manipulating the Trainer_id and fname parameters, an attacker can inject arbitrary SQL code. This flaw can compromise the confidentiality and integrity of the database, allowing unauthorized read or modification of member and trainer data.

The vulnerability targets the Simple Gym Management System provided by code-projects, specifically versions up to 1.0. The insecure logic resides in the func.php script, which processes trainer and member information. Users running any unpatched installation of this product should verify their version and apply updates if available.

With a CVSS base score of 5.1, the risk is moderate. Although no EPSS data is available, the issue has been publicly disclosed and can be exploited remotely via crafted HTTP requests. The vulnerability is not yet listed in the CISA KEV catalog, but its exploitability through a typical web request suggests a realistic attack surface. Organizations should treat this as a potential threat to database integrity and confidentiality.