What is the CVSS score of CVE-2025-69930?

CVE-2025-69930 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Membership Management System are affected by CVE-2025-69930?

CodeAstro Membership Management System 1.0 contains a critical SQL injection vulnerability allowing direct database manipulation through an unsanitized parameter, risking complete compromise of…

How to fix or mitigate CVE-2025-69930?

Within 24 hours, identify all instances of CodeAstro Membership Management System 1.0 in your environment and isolate affected systems from production traffic or restrict access to /print_membership_card.php to trusted administrators only. Within 7 days, conduct a full database audit to detect unauthorized modifications to membership records and review application logs for suspicious SQL queries or unusual data access patterns. Within 30 days, contact CodeAstro for patched releases or implement interim compensating controls including Web Application Firewall (WAF) rules to sanitize SQL metacharacters in the 'id' parameter; if no patch timeline is provided, prepare for application replacement.

Membership Management System CVE-2025-69930

EUVD-2025-210558 CRITICAL

SQL Injection (CWE-89)

2026-07-30 mitre

GHSA-p5mw-247f-x9jr

PHP SQLi N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable SQLi via a GET parameter (AV:N/AC:L/PR:N/UI:N); injection permits reading, altering, and destroying database data, so C:H/I:H/A:H, though PR:N depends on the endpoint being unauthenticated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:29 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 30, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jul 30, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1.

AnalysisAI

SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' GET parameter of /print_membership_card.php. Because the endpoint accepts attacker-controlled input directly into a SQL statement, an attacker can extract, alter, or destroy membership records and potentially compromise the entire application database. A public technical write-up documenting the exact injection point exists (TaintRadar research repository), though there is no public exploit identified as weaponized and EPSS remains very low (0.14%, 4th percentile), indicating no observed widespread exploitation.

Technical ContextAI

The affected component is a PHP web application (CodeAstro Membership Management System, a small off-the-shelf/tutorial-grade PHP+MySQL project) that builds SQL queries by directly concatenating the 'id' request parameter from /print_membership_card.php. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the numeric 'id' value is not parameterized or type-cast before being passed to the database driver. This class of flaw arises when developers interpolate user input into query strings instead of using prepared statements/bound parameters, allowing SQL syntax to be injected. The CPE data provided is uninformative (cpe:2.3:a:n/a:n/a:*:*), so the exact product/vendor CPE is not authoritatively registered - identification relies on the CVE description naming the product and version 1.0.

RemediationAI

No vendor-released patch is identified at time of analysis, so the primary mitigation is code-level: rewrite the query in /print_membership_card.php to use parameterized/prepared statements (e.g., PDO or mysqli bound parameters) and enforce strict integer casting of the 'id' value before it reaches the database. As compensating controls until code can be fixed, restrict access to /print_membership_card.php via authentication/authorization or IP allow-listing (trade-off: may break legitimate public card printing), and deploy a WAF rule to block SQL metacharacters in the 'id' parameter (trade-off: WAF filters can be bypassed and may cause false positives). Running the database account with least privilege (no DROP/ALTER, read-only where possible) limits the integrity/availability impact. Consult the technical write-up (https://github.com/um-dsp/TaintRadar) and VulDB (https://vuldb.com/vuln/384928) for reproduction details to validate the fix.