Executive brief
The CodeAstro Membership Management System is a software platform used to manage member records and generate identification cards. A security flaw in the system's card printing feature allows unauthorized individuals to access the underlying database. This could lead to the theft of sensitive member information, including personal details and registration data.
Technical details
A SQL injection vulnerability exists in CodeAstro Membership Management System 1.0 within the 'print_membership_card.php' script. The application fails to properly sanitize the 'id' GET parameter before using it in a database query. An unauthenticated remote attacker can exploit this by sending specially crafted SQL commands to the server. Successful exploitation allows the attacker to extract sensitive information from the database, potentially including user credentials and member PII. As of the advisory date, there is no mention of a formal patch, so users should implement input validation or use prepared statements to mitigate the risk.
Affected products
- CodeAstro Membership Management System 1.0
Timeline
- 2026-07-30: disclosed: CVE-2025-69930 published by NVD/MITRE