Description
CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.
Published: 2026-07-30
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows an attacker to inject arbitrary SQL commands through the fromDate parameter in report.php and revenue_report.php, potentially exposing sensitive data, modifying database contents, or disrupting service. This weakness corresponds to the Input Validation flaw described by CWE‑89.

Affected Systems

CodeAstro Membership Management System 1.0 is affected. No other vendors or product versions are currently known.

Risk and Exploitability

Exploit is likely remote via crafted HTTP requests to the vulnerable pages, as inferred from the description. The CVE has a CVSS score of 9.8 and an EPSS score of less than 1%, indicating a very low but nonzero exploitation probability. It is not listed in the CISA KEV catalog. The potential impact of full database compromise is high.

Generated by OpenCVE AI on August 3, 2026 at 12:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply vendor patch or upgrade to a fixed version when released
  • Implement input validation and parameterized queries for the fromDate parameter
  • Restrict the database user privileges to read‑only for this application

Generated by OpenCVE AI on August 3, 2026 at 12:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 13:15:00 +0000

Type Values Removed Values Added
Title SQL Injection via fromDate Parameter in CodeAstro Membership Management System 1.0

Fri, 31 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-89
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Codeastro
Codeastro membership Management System
Vendors & Products Codeastro
Codeastro membership Management System

Thu, 30 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Description CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.
References

Subscriptions

Codeastro Membership Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-07-31T19:00:55.601Z

Reserved: 2026-01-09T00:00:00.000Z

Link: CVE-2025-69935

cve-icon Vulnrichment

Updated: 2026-07-31T17:30:16.300Z

cve-icon NVD

Status : Deferred

Published: 2026-07-30T21:16:52.333

Modified: 2026-07-31T19:17:03.420

Link: CVE-2025-69935

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T13:00:07Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')