The CodeAstro Membership Management System version 1.0 contains an SQL injection flaw in the delete_members.php handler, where the 'id' parameter is incorporated directly into a SQL query. An attacker can supply malicious input that is executed by the database, enabling them to delete or modify member records without authentication. This flaw is classified as CWE‑89, indicating a classic input validation failure.

CodeAstro Membership Management System version 1.0 is the only affected product listed. No additional vendor or product information is available.

The CVSS score of 9.8 reflects a critical severity. The EPSS score of less than 1% suggests a low current probability of exploitation, but the vulnerability is still high risk. It is not listed in the CISA KEV catalog. The likely attack vector is a web‑based HTTP GET request to /delete_members.php?id= followed by a crafted payload that injects arbitrary SQL.