Executive brief
CodeAstro Membership Management System, a software used to manage member records and organizational data, contains a security flaw that could allow unauthorized access to its database. By sending a specially crafted web request, an attacker can bypass security controls to view sensitive information stored in the system. This could lead to the exposure of private member details, administrative credentials, or other confidential organizational data.
Technical details
A SQL injection vulnerability exists in CodeAstro Membership Management System 1.0 within the 'edit_member.php' component. The application fails to properly sanitize the 'id' GET parameter before using it in a database query. An unauthenticated remote attacker can exploit this by supplying malicious SQL syntax in the URL, allowing for the extraction of sensitive data from the underlying database. The vulnerability was identified via automated taint analysis (TaintRadar) and affects the member editing functionality. No official patch has been confirmed at the time of reporting.
Affected products
- CodeAstro Membership Management System 1.0
Timeline
- 2026-07-30: disclosed: CVE published to NVD