A flaw in the code-projects Gym Management System In PHP allows a SQL injection attack through manipulation of the "day" parameter in /index.php. This weakness, identified as CWE-89, enables an attacker to inject arbitrary SQL, potentially reading, modifying, or deleting database contents. The vulnerability can affect confidentiality, integrity, and availability of the system’s data, and it can be exploited remotely by submitting a crafted HTTP request to the vulnerable endpoint.

Affected assets include the code-projects Gym Management System In PHP and the associated Windows NT platform; the exact version of the application is unknown. The flaw resides in unknown code within the index.php file of the application, specifically the handling of the "day" argument.

The CVSS score of 5.3 denotes moderate severity. Exploitation is remote and the vulnerability has already been publicized. EPSS data is unavailable and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is a crafted HTTP request that alters the "day" argument sent to index.php, enabling injection of malicious SQL statements.