Executive brief
CodeAstro Membership Management System 1.0 is vulnerable to a security flaw that could allow an attacker to interfere with the application's database. By sending a specially crafted request to the membership type editing feature, an unauthorized user could potentially view, modify, or delete sensitive information stored in the system. This poses a significant risk to the integrity of member data and the overall operation of the management platform.
Technical details
A SQL injection vulnerability exists in CodeAstro Membership Management System 1.0 within the 'edit_type.php' component. The application fails to properly sanitize the 'id' parameter before using it in a database query. An unauthenticated or low-privileged attacker can exploit this by submitting malicious SQL commands via a GET or POST request to the affected endpoint. Successful exploitation allows for unauthorized data extraction, modification of database records, or potentially full administrative bypass depending on the database configuration. No patch is currently documented in the advisory.
Affected products
- CodeAstro Membership Management System 1.0
Timeline
- 2026-07-30: disclosed: Initial CVE publication date