Threat database

A persistent cross-site scripting (XSS) vulnerability exists in GYM One gym management software versions prior to 1.4.1. The vulnerability occurs because the admin/users/index.php page renders user profile fields (firstname, lastname, email) without proper HTML encoding. An attacker able to store malicious script code in these fields can execute arbitrary scripts in an administrator's browser when they view the user list, potentially compromising administrator session data and privileges. This issue is fixed in version 1.4.1.

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the search_name and search_email GET parameters into both the user-list query and the COUNT query used for pagination without prepared statements. An authenticated administrator can inject SQL through either search field to read data from arbitrary tables, including user information and password hashes. Depending on database permissions, the same injection may also permit filesystem writes. This issue is fixed in version 1.4.1.