What is the CVSS score of CVE-2025-69936?

CVE-2025-69936 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Membership Management System are affected by CVE-2025-69936?

CodeAstro Membership Management System 1.0 contains a critical SQL injection vulnerability (CVE-2025-69936, CVSS 9.8) allowing attackers to compromise the member database and extract or modify…

How to fix or mitigate CVE-2025-69936?

Within 24 hours, isolate affected CodeAstro instances from production networks and disable the /edit_member.php endpoint where feasible, then audit database access logs for suspicious activity. Within 7 days, contact CodeAstro for patch availability and timeline; if no patch is forthcoming, evaluate alternative membership management solutions or request a vendor fix commitment with timeline. Within 30 days, either apply the vendor patch to all CodeAstro instances once released, or complete migration to a patched/alternative solution.

Membership Management System CVE-2025-69936

EUVD-2025-210554 CRITICAL

SQL Injection (CWE-89)

2026-07-30 mitre

GHSA-mq7h-f5pm-7rrq

PHP SQLi N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network SQLi with low complexity and high CIA impact, but edit_member.php is an admin record-edit page so PR:L is more honest than PR:N absent proof of broken auth.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:30 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 30, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jul 30, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.

AnalysisAI

SQL injection in CodeAstro Membership Management System 1.0 allows attackers to manipulate backend database queries through the unsanitized 'id' parameter of /edit_member.php, enabling extraction or modification of member records and potentially full database compromise. The flaw is a classic CWE-89 error where user-supplied input is concatenated directly into a SQL statement. Publicly available exploit code exists in a documented writeup, though the vulnerability carries a low EPSS probability (0.14%) and is not in CISA KEV, indicating no confirmed active exploitation.

Technical ContextAI

The affected software is CodeAstro Membership Management System, a small open-source PHP/MySQL web application used to manage membership records. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the /edit_member.php script accepts an 'id' GET parameter and appends it into a SQL query without parameterization or input validation, allowing an attacker to break out of the intended query context. The CPE string provided (cpe:2.3:a:n/a:n/a:*) is a placeholder with no real vendor/product mapping, so exact affected packaging must be confirmed from the CodeAstro source distribution rather than NVD CPE data. The stack is standard LAMP-style PHP, and the injection point is a direct reflected parameter typical of scripts that build queries via string concatenation.

RemediationAI

No vendor-released patch version is identified in the available data, so plan on source-level remediation: rewrite the /edit_member.php query to use parameterized/prepared statements (PDO or mysqli bound parameters) so the 'id' value is never concatenated into SQL, and add server-side validation enforcing that 'id' is a positive integer. As compensating controls until code is fixed, restrict access to edit_member.php and other admin pages behind authenticated sessions and IP allow-listing (trade-off: may break legitimate remote admin), and deploy a WAF rule to block SQL metacharacters in the 'id' parameter (trade-off: WAF signatures can be bypassed and may cause false positives on legitimate values). Consult the technical writeup at https://github.com/um-dsp/TaintRadar (TaintRadar SQLi documentation) and the VulDB advisory (https://vuldb.com/vuln/384933) for the exact injection point. Do not expose this application directly to the internet while unpatched.