The vulnerability resides in the Payment Handler component of the Simple Gym Management System 1.0. Manipulating the Payment_id, Amount, customer_id, payment_type, or customer_name parameters allows a remote attacker to inject malicious SQL code. This can potentially grant unauthorized access to the database, expose confidential data, or allow further compromise of the application’s integrity. The weakness is identified as a classic SQL injection (CWE‑74, CWE‑89).

Affected by the 1.0 release of the Simple Gym Management System from code-projects. No other vendors or product versions are listed.

The CVSS score of 5.3 indicates moderate risk. EPSS data is unavailable, and the issue is not listed in the KEV catalog, suggesting it is not widely exploited in the wild yet. Remote exploitation is possible through crafted input to the Payment Handler endpoint. No formal patch has been released, making the vulnerability exploitable as long as the vulnerable code remains unpatched.