Gym One’s admin/users/index.php concatenates user-supplied GET parameters, search_name and search_email, directly into SQL statements without using prepared statements. This allows an authenticated administrator to inject arbitrary SQL code through either input field. The vulnerability can be used to read sensitive data from any table, including user details and password hashes, and, depending on database privileges, may also enable writes to the filesystem. The weakness is a classic SQL injection scenario classified as CWE‑89.

The affected product is GYM One, an open‑source gym management application. Versions released before 1.4.1 are vulnerable because the injection vector exists in admin/users/index.php. The vulnerability was resolved in release 1.4.1, which replaced the insecure string concatenation with safe query handling.

The CVSS score of 6.5 signals a moderate severity that can compromise confidentiality and integrity of user data. The EPSS score is <1%, indicating that widespread exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to require that an attacker has already authenticated as an administrator and is able to send crafted GET requests to the vulnerable endpoint. Under those conditions, the attacker could retrieve arbitrary data and possibly write to the file system if the database user has sufficient privileges.