EUVD-2025-210557
GHSA-7763-rg25-m3fc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated GET request to an unsanitized id parameter (AV:N/AC:L/PR:N/UI:N) yields full SQLi over the database, giving total C/I/A impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1.
AnalysisAI
SQL injection in CodeAstro Membership Management System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL through the 'id' parameter of /delete_membership.php, enabling full database compromise. The flaw carries a CVSS 9.8 rating with SSVC noting a public proof-of-concept and 'total' technical impact, though publicly available exploit code exists rather than confirmed active exploitation. Despite the critical severity, EPSS estimates only a 0.14% exploitation probability (4th percentile), reflecting the product's niche footprint.
Technical ContextAI
The vulnerability is a classic CWE-89 SQL Injection in a PHP web application built on the CodeAstro Membership Management System codebase (a low-cost/free PHP+MySQL project template). The /delete_membership.php script accepts an 'id' GET parameter that is concatenated directly into a backend SQL DELETE (or associated SELECT) statement without parameterization or input sanitization, so attacker-controlled input is interpreted as SQL syntax. Because the endpoint drives a delete operation and the injection point is a numeric-looking parameter, both stacked/boolean/UNION-based extraction and destructive queries are plausible against the underlying MySQL/MariaDB store. The CPE data is uninformative ('cpe:2.3:a:n/a:n/a') so exact affected package identifiers are not machine-enumerable and must be inferred from the description and reference material.
RemediationAI
No vendor-released patch identified at time of analysis for CodeAstro Membership Management System 1.0. The definitive fix is to rewrite the /delete_membership.php query to use parameterized queries/prepared statements (PDO or mysqli bound parameters) and to cast/validate the 'id' parameter as a strict integer before use; this should be applied across all endpoints since the same coding pattern likely recurs. As compensating controls until source-level remediation, place the application behind a WAF with SQL-injection rules targeting the id parameter (trade-off: rule bypasses are common, so treat as detection not prevention), restrict network access to the admin/membership management pages via IP allowlisting or authentication gating on the web server (trade-off: may break legitimate remote admin access), and enforce least-privilege database accounts so the web user cannot drop tables or read unrelated schemas (trade-off: does not stop data theft within its own database). Consult the technical write-up at https://github.com/um-dsp/TaintRadar and the advisory at https://nvd.nist.gov/vuln/detail/CVE-2025-69931.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today