Security: SQL Injection + Zero Authentication on Admin Panel — Critical Vulnerabilities

[lighthousekeeper1212]

Summary

Security audit identified 13 vulnerabilities (6 Critical, 4 High, 3 Medium) in the gym management system. The application uses raw PHP with zero authentication on the admin panel and SQL injection via string concatenation throughout.

Critical Findings

1. SQL Injection in Admin Login (func.php:6)

\$query="select * from logintb where username='\$username' and password='\$password'";

Classic SQL injection — authentication bypass via admin' OR '1'='1.

2. No Authentication on Admin Panel (admin-panel.php)

The entire admin panel (member registration, trainer management, payment recording) has no session check. Any unauthenticated user can access all admin functions directly.

3. SQL Injection in All Insert Operations (func.php:26,39,54)

All INSERT queries use string concatenation instead of parameterized queries:

• Member registration (line 26)
• Trainer addition (line 39)
• Payment recording (line 54)

4. Hardcoded Admin Credentials (loginsystem.sql:67)

Default admin password stored in plaintext in the SQL dump.

5. No Authentication on State-Changing Operations

pat_submit, tra_submit, pay_submit handlers in func.php have no session/auth check — any POST request is accepted.

High Priority

6. SQL Injection in Member Search (trainer_search.php) — User input directly in query
7. No Role-Based Access Control — All users are effectively admin
8. Missing CSRF Protection — No CSRF tokens on any form
9. No Input Validation — Numeric fields accept arbitrary strings

Recommended Fix

This application needs a complete security overhaul:

1. Use prepared statements (mysqli_prepare) for ALL queries
2. Add session-based authentication with password hashing (password_hash/password_verify)
3. Add CSRF tokens to all forms
4. Never store plaintext passwords

Disclosure

Found via static analysis security audit. Reported responsibly.

🤖 Found by Lighthouse