CVE-2025-1188: Medium SQL Injection in Codezips Gym Management

CVE-2025-1188 is a medium SQL injection flaw in Codezips Gym Management System 1.0, in /dashboard/admin/updateroutine.php through the tid parameter. NVD scores it 6.3. The record names no fixed version and says a public exploit exists, so patch the code with parameterised queries and limit who can reach the app.

What's affected

The NVD record names Codezips Gym Management System version 1.0. The affected code is the file /dashboard/admin/updateroutine.php, and the argument that matters is tid. The CVSS vector lists a low privilege requirement, so a signed in account is part of the picture, although the public write-up says no authentication is needed. Check your own copy to see which is true.

The record says the attack can be launched remotely and that the exploit has been made public. It does not give a patched version. The record does not say whether the maintainer plans a fix, so do not wait for one.

If you run it, treat the code as yours. The fix is a change to the query in that file, and a developer can make it.

How to check if you're exposed

1. Find out whether the application runs anywhere in your estate, including test servers, student projects and forgotten demos. A search of your web roots for the file name is quick: find /var/www -name "updateroutine.php".
2. Open that file in your own copy and look for the tid value being placed directly into a query string. If it is joined into SQL text with a dot or a plus sign and not bound as a parameter, the code has the flaw.
3. Check the application's database account. If it connects as a database administrator or owns more tables than it needs, the impact of any injection is larger.
4. Search your web server logs for requests to that file with unusual characters in the tid value, which will tell you whether anyone has probed it.

A static analysis scan of the source finds this pattern well. Every injectable query tends to look the same to a code scanner.

What to do now

1. If this app is not needed, take it offline. Sample applications rarely belong in production.
2. If you need it, change the query in updateroutine.php to use a prepared statement, and bind the tid value as a parameter. For example, with mysqli:

$stmt = $conn->prepare("SELECT * FROM items WHERE id = ?");
$stmt->bind_param("s", $value);
$stmt->execute();

3. Repeat the change for every other query in the application. A flaw in one file usually has siblings.
4. Give the database account only the rights the app needs, and keep it away from other databases.
5. Put the app behind a login or an IP allow list, and add a web application firewall rule as a stopgap, not as the fix.
6. Check back for a vendor update, since the record lists none.

Why it matters

The weaknesses are CWE-89, SQL injection, and CWE-74, injection in general. They arise when untrusted input becomes part of a command that another system interprets. The database cannot tell the developer's SQL from the attacker's, so it runs both.

This one is scored medium because the vector lists low privileges and low impact on each of confidentiality, integrity and availability. The vector understates the worst case, since SQL injection can in principle read and change anything the database account can reach. A gym system holds names, contact details and possibly payment related records, so data exposure matters even when the score looks modest.

The record does not mark this CVE as exploited and it is not in the CISA Known Exploited Vulnerabilities catalog. It does say a public exploit exists. Small applications like this are easy targets for automated scanning because their file names and parameters are public.

Quick check

Sources

• Public write-up listed in the NVD record

Last reviewed: 19 October 2026.