An attacker can inject arbitrary SQL statements through the id parameter in the delete_membership.php script of the CodeAstro Membership Management System, allowing the execution of unintended database commands. By crafting malicious input, an adversary can read, modify, or delete data, potentially leading to the loss of data confidentiality, integrity, and availability. The weakness is a classic SQL Injection (CWE‑89) caused by insufficient input sanitization or the use of non‑parameterized queries.

CodeAstro Membership Management System, version 1.0. No additional vendor or product details are provided.

The CVSS score of 9.8 indicates critical severity. Based on the EPSS score of < 1 %, the likelihood of exploitation is very low, though the vulnerability remains a high‑impact risk. This flaw is remotely exploitable via the web interface, allowing access to the underlying database if an attacker can reach the delete_membership.php endpoint. The vulnerability is not listed in the CISA KEV catalog. The risk persists until a patch or mitigation is applied. The attack vector is inferred from the description to be a web‑based exploitation through the id parameter.