Description
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.
Published: 2026-07-30
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The CodeAstro Membership Management System 1.0 contains a flaw in the renew.php script where the membershipType parameter is inserted directly into an SQL statement without proper sanitization. This classic SQL injection (CWE-89) allows an attacker to execute arbitrary database commands, potentially reading, modifying, or deleting member data and corrupting application state.

Affected Systems

The vulnerability applies to the CodeAstro Membership Management System version 1.0. No additional vendors or products are mentioned in the available information.

Risk and Exploitability

The CVSS score of 9.8 reflects a critical severity level, while the EPSS score is less than 1%, indicating a low current exploitation probability. Based on the description, it is inferred that the vulnerability is triggered via the publicly reachable renew.php endpoint, meaning attackers who can access this URL can provide a crafted membershipType value to inject SQL. The impact ranges from data exposure to full database compromise. The vulnerability is not listed in CISA’s KEV catalog, but the combined high impact and potential for low effort exploitation warrants immediate attention.

Generated by OpenCVE AI on August 4, 2026 at 12:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a patched or newer version of CodeAstro Membership Management System that eliminates the SQL injection in renew.php.
  • Refactor the renew.php code to use parameterized queries or prepared statements for the membershipType value.
  • Add strict input validation: enforce that membershipType matches a known list of numeric identifiers or whitelist before inclusion in the SQL query.
  • Restrict the database account used by the application to the minimum privileges required, disabling unnecessary DML or DDL rights.
  • Deploy application layer monitoring or WAF rules to detect and block anomalous SQL injection attempts targeting membershipType.

Generated by OpenCVE AI on August 4, 2026 at 12:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Title CodeAstro Membership Management System 1.0 SQL Injection via membershipType

Sun, 02 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Codeastro
Codeastro membership Management System
Vendors & Products Codeastro
Codeastro membership Management System

Fri, 31 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
Title CodeAstro Membership Management System 1.0 SQL Injection via membershipType

Fri, 31 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-89
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Description CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.
References

Subscriptions

Codeastro Membership Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-07-31T14:32:12.605Z

Reserved: 2026-01-09T00:00:00.000Z

Link: CVE-2025-69938

cve-icon Vulnrichment

Updated: 2026-07-31T14:31:34.096Z

cve-icon NVD

Status : Deferred

Published: 2026-07-30T21:16:52.670

Modified: 2026-07-31T15:16:27.233

Link: CVE-2025-69938

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T12:30:09Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')