CodeAstro Membership Management System 1.0 contains a SQL injection flaw in the memberProfile.php page that accepts an untrusted id parameter via a GET request. The vulnerability allows an attacker to inject arbitrary SQL statements, potentially exposing, modifying, or deleting data stored in the underlying database. The impact is limited to the database content accessed by the application and does not directly lead to remote code execution, but it can be leveraged to gain unauthorized access to sensitive member information or alter stored data.

The flaw affects the CodeAstro Membership Management System version 1.0 as implemented on a web server that serves the memberProfile.php script. No CPE or vendor enumeration data are available in the CVE record, but the reference indicates a typical PHP‑based membership platform.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of < 1% suggests a low but non‑zero probability of exploitation. The vulnerability can be attacked remotely by crafting a URL such as /memberProfile.php?id=1 OR 1=1; SELECT …, indicating that standard web access is sufficient for exploitation. The vulnerability is not listed in the CISA KEV catalog, implying that no confirmed exploits are in widespread use. Nonetheless, the theoretical risk of data compromise warrants immediate attention.