Executive brief
CodeAstro Membership Management System is a PHP-based platform for managing member records and subscriptions. The delete_members.php endpoint fails to verify user authentication and accepts unsanitized input, allowing unauthenticated attackers to delete arbitrary member records and potentially access or modify sensitive database information. This could result in permanent loss of customer data, service outages, and regulatory compliance issues.
Technical details
The vulnerability combines missing authentication (CWE-306/CWE-862) and SQL injection (CWE-89) in the delete_members.php endpoint. The script accepts an id parameter via GET requests without verifying an active authenticated session, and directly concatenates this parameter into SQL DELETE queries without parameterized statements or input validation. Attackers can craft malicious id values (e.g., "-1 OR 1=1; --") to delete arbitrary records or extract/modify database contents depending on database account privileges. No authentication, authorization, or CSRF token validation is enforced. Fixes require session verification at script entry, conversion to POST with CSRF protection, parameterized queries, input type casting, and principle of least privilege for database accounts.
Affected products
- CodeAstro Membership Management System 1.0
Timeline
- 2026-02-18: disclosed: CVE-2025-70150 published
- 2025-12-26: other: Vulnerability discovered by MinhKhoa