Executive brief
CodeAstro Membership Management System 1.0 is vulnerable to a security flaw where an attacker can manipulate database queries. This system is typically used to manage member records and profiles. By exploiting this vulnerability, an unauthorized individual could potentially view, modify, or delete sensitive member data stored in the database, leading to a significant breach of privacy and data integrity.
Technical details
A SQL injection vulnerability exists in CodeAstro Membership Management System 1.0 within the '/memberProfile.php' endpoint. The application fails to properly sanitize the 'id' GET parameter before using it in a database query. An unauthenticated or low-privileged attacker can provide malicious SQL commands through this parameter to bypass intended query logic. This can lead to unauthorized data extraction (including sensitive member information), modification of database records, or potentially full database compromise depending on the database user permissions. No patch is currently documented in the advisory.
Affected products
- CodeAstro Membership Management System 1.0
Timeline
- 2026-07-30: disclosed: CVE published to NVD