A classic SQL injection flaw exists in the Membership Management System’s print_membership_card.php page, where the id parameter is passed directly into a database query without proper sanitisation. An attacker can inject arbitrary SQL commands through this parameter, allowing read, modify or delete operations on the underlying database. The impact includes theft of member records, potential alteration of membership statuses, creation of rogue administrative credentials, and broader compromise of the system’s confidentiality and integrity.

The affected product is the CodeAstro Membership Management System, version 1.0. The vulnerability is triggered by accessing the /print_membership_card.php endpoint with an id query string, such as /print_membership_card.php?id=1. No other product versions are listed in the available data.

The EPSS score is < 1%, indicating a very low but non-zero exploitation probability, and the issue is not listed in the CISA KEV catalog. Nevertheless, the flaw is exploitable over the network, requiring only that the attacker can reach the vulnerable endpoint and submit a crafted id value. Because the affected code directly concatenates user input into an SQL statement, the attack is straightforward for an automated exploitation script. The potential damage aligns with a high‑severity rating on a CVSS scale, with an exact score of 9.8 indicated in the source data.