What is the CVSS score of CVE-2025-69934?

CVE-2025-69934 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of CodeAstro Membership Management System are affected by CVE-2025-69934?

CodeAstro Membership Management System 1.0 contains a critical unauthenticated SQL injection vulnerability enabling attackers to read, modify, or delete your entire member database without…

How to fix or mitigate CVE-2025-69934?

Within 24 hours, inventory all CodeAstro Membership Management System 1.0 deployments and confirm network accessibility of the /delete_members.php endpoint; baseline current member database integrity with a full dump or checksum verification. Within 7 days, deploy Web Application Firewall (WAF) rules to block SQL injection patterns targeting the 'id' parameter, implement database account privilege restrictions to minimum necessary operations, and contact CodeAstro support to confirm patch timeline or request security advisory; if immediate code modification is feasible, implement parameterized query construction for the 'id' parameter. Within 30 days, complete a vendor evaluation and procurement for a replacement membership management solution or a patched CodeAstro version, execute comprehensive regression testing in a staging environment, and migrate to the remediated platform.

CodeAstro Membership Management System CVE-2025-69934

EUVD-2025-210556 CRITICAL

SQL Injection (CWE-89)

2026-07-30 mitre

GHSA-93xq-47f6-wqhv

PHP SQLi N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network SQLi with low complexity, but a member-deletion admin endpoint likely requires at least a low-privileged authenticated session, so PR:L; full database read/modify/delete gives C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:29 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 30, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jul 30, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.

AnalysisAI

SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of /delete_members.php. Per the supplied CVSS 3.1 vector (PR:N), no authentication is required, giving attackers full read/write/delete access to the underlying database. There is no public exploit identified at time of analysis, though a TaintRadar research write-up documenting the flaw is referenced; the EPSS score is low (0.14%, 4th percentile) and the CVE is not listed in CISA KEV.

Technical ContextAI

The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) affecting a PHP-based web application that manages membership records. The affected endpoint, delete_members.php, takes an 'id' GET parameter and appears to concatenate it directly into a SQL DELETE/SELECT statement without parameterization or input validation. Because CodeAstro Membership Management System is a small PHP + MySQL application, exploitation likely uses standard MySQL injection syntax (UNION-based extraction, boolean/time-based blind, or stacked/piggy-backed queries). The CPE string supplied (cpe:2.3:a:n/a:n/a) is a placeholder with no meaningful vendor/product data, so exact product identification rests on the description and MITRE/EUVD text rather than structured NVD CPE.

RemediationAI

No vendor-released patch version is identified at time of analysis, so remediation centers on code-level and compensating controls. The definitive fix is to rewrite the delete_members.php query to use parameterized queries / prepared statements (PDO or mysqli with bound parameters) and to cast the 'id' value to an integer before use, since it is a numeric record identifier. As immediate compensating controls: place the endpoint behind enforced admin authentication and authorization checks (confirm it is not reachable unauthenticated), restrict access to the /delete_members.php path via web-server ACLs or IP allow-listing for administrators, and deploy a WAF rule to block SQL metacharacters in the 'id' parameter - noting a WAF is a stopgap that can be bypassed and may break legitimate requests. Also apply least-privilege to the application's database account so it cannot perform destructive or cross-database operations. Monitor VulDB (https://vuldb.com/vuln/384931) and the NVD entry for an official fixed release before relying on an upgrade.