Executive brief
CodeAstro Membership Management System is a PHP-based application for managing member records and subscriptions. The system contains a critical vulnerability in its membership card printing feature that allows attackers to bypass authentication and extract sensitive data (member PII, administrative credentials, passwords) or modify/delete database records without any credentials required.
Technical details
The vulnerability is an unauthenticated SQL injection (CWE-89) in print_membership_card.php where the user-supplied 'id' GET parameter is concatenated directly into an SQL SELECT query without parameterization or input validation. The vulnerable code reads $memberId = $_GET['id'] and embeds it directly into a query joining members and membership_types tables. The endpoint requires no authentication, making it remotely exploitable via direct HTTP requests. Attackers can leverage boolean-based or UNION-based SQL injection to extract sensitive records (e.g., email and password from the users table), modify data if database privileges permit, or cause denial-of-service via time-based queries. Remediation requires using prepared statements, strict integer validation/casting of the id parameter, and enforcement of authentication controls.
Affected products
- CodeAstro Membership Management System 1.0
Timeline
- 2025-12-27: disclosed: Vulnerability discovered by MinhKhoa
- 2026-02-18: advisory: CVE-2025-70149 published on NVD
- 2026-02-19: advisory: Detailed technical advisory published