This vulnerability affects the Gym Management System In PHP version 1.0 by code-projects. It allows an attacker to perform SQL injection by manipulating the 'day' parameter in the /index.php file. The attack vector is network-based with low attack complexity and no user interaction required. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No official fix or patch is currently documented, and the vendor has not provided remediation details. The vulnerability state is published and the exploit code has been made public, increasing the risk of exploitation.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to the limited scope of the vulnerability and the low complexity of the attack. There is no indication of privilege escalation or complete system compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation and parameterized queries on the 'day' parameter in /index.php to mitigate SQL injection risks. Monitor for vendor updates regarding patches or official mitigations.