A vulnerability in the file upload functionality of CODEASTRO Membership Management System v1.0 enables attackers to upload malicious files due to lack of proper sanitization. By injecting executable content, an attacker can run arbitrary code on the web server, effectively gaining full control over the affected system. The impact is a complete compromise of confidentiality, integrity, and availability for the targeted installation.

The affected product is the CODEASTRO Membership Management System, version 1.0, accessed via the /add_members.php endpoint. No other versions or vendors are listed as vulnerable.

The vulnerability presents a high risk because it permits remote code execution without authentication. Its exploitability is relatively straightforward—an attacker must submit a crafted file through the upload interface, a step that can be performed over a public web service. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of any mitigation provided by the vendor combined with the potential for uncontrollable code execution warrants a high threat rating.