The CodeAstro Membership Management System version 1.0 contains a critical SQL Injection flaw in the edit_type.php endpoint. The id parameter is concatenated directly into an SQL query, allowing an attacker to inject arbitrary SQL statements. This can lead to unintended data exfiltration, modification, or deletion of the membership database, thereby compromising both confidentiality and integrity of the application data.

The vulnerability is limited to CodeAstro Membership Management System 1.0 and specifically targets the edit_type.php endpoint used for changing user types. No other products or versions are enumerated as affected.

With a CVSS score of 9.8 the flaw is classified as critical. Although the EPSS score is below 1%, indicating a low probability of exploitation in the wild, the exploit remains possible and could be used by adversaries with network access to the application. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is over the web interface, potentially without authentication if the endpoint does not enforce proper access controls, otherwise it requires administrative credentials.