CodeAstro Membership Management System 1.0 contains a classic SQL Injection flaw in the edit_member.php script. The vulnerability resides in the handling of the id parameter in the URL, which is interpolated directly into an SQL query without sanitization. An attacker able to supply a crafted id value could inject arbitrary SQL commands. The impact could range from data disclosure to modification or deletion of user records, effectively compromising confidentiality, integrity, and availability of the membership database.

The affected product is CodeAstro Membership Management System version 1.0. The vulnerability is specifically tied to the edit_member.php script reachable at the path /edit_member.php?id=1. Users running version 1.0 of the system in a production or exposed environment are at risk. No vendor or official patch is listed in the CVE data, so any deployment of the affected version should be considered vulnerable.

The CVSS score is 9.8 and the EPSS score is less than 1%, indicating a severe risk but a very low probability of exploitation at this time. KEV does not list the vulnerability, so no confirmed exploits are publicly known. Nevertheless, SQL injection vulnerabilities inherently carry high potential for remote attackers to execute arbitrary database commands, and the likely attack vector is the web interface via the id query string, which an unauthenticated or authenticated attacker may control. Without mitigation, the risk remains potentially severe, especially for systems exposing the edit_member endpoint to the internet.