CVE-2024-6652

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in itsourcecode Gym Management System 1.0. It has been classified as critical. This affects an unknown part of the file manage_member.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271059.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Gym Management System	1.0
gym_management_system_project	gym_management_system	1.0

References

https://github.com/littletree7/cve/issues/1Exploit
https://vuldb.com/?ctiid.271059Permissions Required, Third Party Advisory
https://vuldb.com/?id.271059Permissions Required, Third Party Advisory
https://vuldb.com/?submit.372193Third Party Advisory
https://github.com/littletree7/cve/issues/1Exploit
https://vuldb.com/?ctiid.271059Permissions Required, Third Party Advisory
https://vuldb.com/?id.271059Permissions Required, Third Party Advisory
https://vuldb.com/?submit.372193Third Party Advisory

Timeline

Published: Jul 10, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-66539.8A vulnerability was found in code-projects Simple Task List 1.0. It has been declared as critical. This vulnerability affects unknown code o CVE-2024-66546.8Products for macOS enables a user logged on to the system to perform a denial-of-service attack, which could be misused to disable the prote CVE-2024-66557.0A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the c CVE-2024-66569.8Use of Hard-coded Credentials vulnerability in TNB Mobile Solutions Cockpit Software allows Read Sensitive Strings Within an Executable. Th CVE-2024-66576.5A denial of service may be caused to a single peripheral device in a BLE network when multiple central devices continuously connect and dis CVE-2024-66586.8Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows OS Command Injection.This issue affects:  Pro CVE-2024-66608.8The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modif CVE-2024-66614.4The ParityPress – Parity Pricing with Discount Rules plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Discount Text' CVE-2024-66628.7Websites managed by MegaBIP in versions below 5.15 are vulnerable to Cross-Site Request Forgery (CSRF) as the form available under "/edytor/CVE-2024-66654.8The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high CVE-2024-66668.8The WP ERP plugin for WordPress is vulnerable to SQL Injection via the ‘vendor_id’ and 'status' parameter in all versions up to, and includi CVE-2024-66676.1The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outputting it back in the