# CVE-2025-70149: CodeAstro Membership Management System SQL injection in print_membership_card.php

Source: https://junglewise.ai/threats/cve-2025-70149-codeastro-membership-management-system-sql-injection-in-print  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-70149 · Severity: critical · CVSS 9.8 · Published 2026-02-18

CodeAstro Membership Management System is a PHP-based application for managing member records and subscriptions. The system contains a critical vulnerability in its membership card printing feature that allows attackers to bypass authentication and extract sensitive data (member PII, administrative credentials, passwords) or modify/delete database records without any credentials required.

Technologies: [CodeAstro Membership Management System](https://junglewise.ai/threats/technologies/membership-management-system). Vendors: [CodeAstro](https://junglewise.ai/threats/vendors/codeastro).

## Quick answers

**Is CVE-2025-70149 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-70149 being exploited in the wild.

**How severe is CVE-2025-70149?** Critical severity, with a CVSS score of 9.8, published 18 February 2026.

**Which products and versions are affected?** CodeAstro Membership Management System 1.0.

**Is there a fix for CVE-2025-70149?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-70149 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2025-70149?** Check whether you run CodeAstro Membership Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an unauthenticated SQL injection (CWE-89) in print_membership_card.php where the user-supplied 'id' GET parameter is concatenated directly into an SQL SELECT query without parameterization or input validation. The vulnerable code reads $memberId = $_GET['id'] and embeds it directly into a query joining members and membership_types tables. The endpoint requires no authentication, making it remotely exploitable via direct HTTP requests. Attackers can leverage boolean-based or UNION-based SQL injection to extract sensitive records (e.g., email and password from the users table), modify data if database privileges permit, or cause denial-of-service via time-based queries. Remediation requires using prepared statements, strict integer validation/casting of the id parameter, and enforcement of authentication controls.

## Affected products

- CodeAstro Membership Management System 1.0

## Timeline

- 2025-12-27: disclosed: Vulnerability discovered by MinhKhoa
- 2026-02-18: advisory: CVE-2025-70149 published on NVD
- 2026-02-19: advisory: Detailed technical advisory published

## References

- [https://0x0bito.github.io/posts/CVE-2025-70149-Membership-SQLi/](https://0x0bito.github.io/posts/CVE-2025-70149-Membership-SQLi/)
- [https://www.phpscriptsonline.com/product/membership-management-software](https://www.phpscriptsonline.com/product/membership-management-software)

## Related threats

- [CodeAstro Membership Management System SQL injection in renew.php](https://junglewise.ai/threats/cve-2025-69938-codeastro-membership-management-system-sql-injection-in-renew-php)
- [CodeAstro Membership Management System SQL injection in edit_type.php](https://junglewise.ai/threats/cve-2025-69937-codeastro-membership-management-system-sql-injection-in-edit-type)
- [CodeAstro Membership Management System SQL injection in edit_member.php](https://junglewise.ai/threats/cve-2025-69936-codeastro-membership-management-system-sql-injection-in-edit)
- [CodeAstro Membership Management System SQL injection in reporting modules](https://junglewise.ai/threats/cve-2025-69935-codeastro-membership-management-system-sql-injection-in-reporting)
- [CodeAstro Membership Management System SQL injection in delete_members.php](https://junglewise.ai/threats/cve-2025-69934-codeastro-membership-management-system-sql-injection-in-delete)