The vulnerability resides in the fwrite function of admin/pageMail.php in version 1.0 of the Chamber of Commerce Membership Management System. By manipulating the mailSubject or mailMessage parameters, an attacker can inject arbitrary commands into the server’s command line, leading to remote command execution. This falls under CWE‑74 (Command Injection) and CWE‑77 (OS Command Injection). Successful exploitation would compromise the confidentiality, integrity and availability of the affected system by enabling an attacker to run arbitrary code on the host.

The only affected product is the Chamber of Commerce Membership Management System version 1.0, released by code‑projects.

The CVSS score of 5.1 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger the flaw remotely through the web interface; the exploit is publicly available. The risk is moderate but real, as an attacker who gains access can execute arbitrary commands on the server. Mitigation requires patching or input sanitization to block the injection.