This vulnerability in Simple Gym Management System 1.0 arises from improper sanitization of input parameters in the Payment Handler component. Specifically, the arguments Payment_id, Amount, customer_id, payment_type, and customer_name can be manipulated to inject SQL commands. The vulnerability is remotely exploitable with low attack complexity and no user interaction required. The CVSS 4.0 base score is 5.3, reflecting medium severity. No vendor patch or fix information is available in the provided data.

Successful exploitation could allow an attacker with low privileges to perform SQL injection attacks remotely, potentially leading to unauthorized data access or modification within the affected system. The impact is rated medium severity based on the CVSS score and vector, indicating limited but significant risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries in the Payment Handler component to mitigate SQL injection risks.