What is the CVSS score of CVE-2025-69937?

CVE-2025-69937 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of CodeAstro Membership Management are affected by CVE-2025-69937?

CodeAstro Membership Management System 1.0 contains a critical SQL injection vulnerability (CVE-2025-69937, CVSS 9.8) that enables complete database compromise, affecting member records, credentials,…

How to fix or mitigate CVE-2025-69937?

Within 24 hours: Inventory all CodeAstro 1.0 instances and member record volumes; assess network exposure of edit_type.php and breach impact if exploited. Within 7 days: Deploy Web Application Firewall rules blocking SQL injection patterns in the 'id' parameter of edit_type.php; implement strict input validation and parameterized queries at the application level; enforce least-privilege database service accounts; consider disabling edit_type.php if operationally non-critical. Within 30 days: Request CodeAstro security roadmap and timeline for patched release; evaluate CodeAstro Membership Management System 2.x or alternative membership platforms; plan and execute migration to a patched or alternative solution.

CodeAstro Membership Management CVE-2025-69937

EUVD-2025-210552 CRITICAL

SQL Injection (CWE-89)

2026-07-30 mitre

GHSA-r8jw-g6jc-xrf7

PHP SQLi N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable SQLi per CVSS/description gives AV:N/AC:L/PR:N with full DB C/I/A impact; PR:N retained but flagged as unverified since edit_type.php may be an admin endpoint.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:26 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 30, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jul 30, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.

AnalysisAI

SQL injection in CodeAstro Membership Management System 1.0 lets attackers manipulate the backend database through the unsanitized 'id' parameter of the edit_type.php endpoint (CWE-89). The maximal CVSS 9.8 vector reflects full compromise of confidentiality, integrity, and availability, though the low EPSS score (0.14%, 4th percentile) indicates minimal observed exploitation activity to date. The flaw is documented in public research (TaintRadar) and VulDB, but no public weaponized exploit or active exploitation is confirmed.

Technical ContextAI

The affected software is CodeAstro's Membership Management System, a PHP/MySQL web application distributed as ready-made source code for managing member records and membership types. The vulnerability is a classic CWE-89 SQL Injection: the edit_type.php script incorporates the user-supplied 'id' GET/POST parameter directly into a SQL query without parameterization or input sanitization, allowing an attacker to break out of the intended query context and inject arbitrary SQL. The 'PHP' and 'SQLi' tags confirm the technology stack. Note the CPE string provided (cpe:2.3:a:n/a:n/a:*) is a placeholder ('n/a') and does not encode a usable vendor/product identifier, so exact CPE-based matching is not possible from the supplied data.

RemediationAI

No vendor-released patch identified at time of analysis, and no fixed version is present in the source data. The primary code-level fix is to rewrite the edit_type.php query to use parameterized queries / prepared statements (PDO or mysqli with bound parameters) and to enforce that 'id' is a strictly validated integer via a server-side cast or whitelist. As compensating controls until a vendor fix exists: restrict access to the administrative endpoint (edit_type.php and the admin directory) to trusted IPs or behind authenticated/VPN access, which limits exposure but may break legitimate remote admin use; deploy a WAF rule to block SQL metacharacters in the 'id' parameter, accepting the risk of bypass via encoding; and enforce least-privilege on the application's database account (no DROP/FILE/admin grants) to cap the blast radius of a successful injection, though this does not prevent data exfiltration. Consult the VulDB advisory (https://vuldb.com/vuln/384934) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-69937) for updates.