EUVD-2025-210553
GHSA-ch8h-jfj9-3qgf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated SQLi over HTTP with no user interaction (AV:N/AC:L/PR:N/UI:N); injection into the DB query enables read, modify, and destructive impact, so C/I/A all High.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.
AnalysisAI
SQL injection in CodeAstro Membership Management System 1.0 lets remote unauthenticated attackers manipulate backend database queries through the 'id' parameter of /memberProfile.php, enabling extraction or modification of member records and potential full database compromise. The flaw is trivially reachable over the network (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) and a public technical writeup exists in the TaintRadar research repository, though it is not listed in CISA KEV. EPSS is low at 0.14% (4th percentile), indicating no observed mass exploitation to date despite the maximal severity score.
Technical ContextAI
The affected application is a PHP-based web application (tagged PHP/SQLi) that builds a SQL query for the member-profile view using the user-supplied 'id' URL parameter without proper parameterization or input sanitization. This is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) defect: the 'id=1' value in /memberProfile.php is concatenated directly into a database query, so injected SQL meta-characters (quotes, UNION, boolean/time-based payloads) are interpreted as query logic rather than data. Because membership systems typically store personal, credential, and account data, the injectable query provides a direct path to the underlying datastore. CPE data is uninformative here (cpe:2.3:a:n/a:n/a - vendor/product recorded as 'n/a'), so exact-product identification relies on the CVE description and the referenced writeup rather than structured CPE.
RemediationAI
No vendor-released patch version was identified at time of analysis, so remediation should focus on code-level and compensating controls: rewrite the /memberProfile.php query to use parameterized queries/prepared statements (PDO or mysqli bound parameters) so the 'id' value is never concatenated into SQL, and add server-side validation enforcing that 'id' is a positive integer, which alone blocks the documented vector with no functional downside. As interim compensating controls, place the application behind a WAF with SQLi signatures tuned to the id parameter (trade-off: signature bypasses are possible and this is not a fix), restrict access to the membership application to authenticated/internal users or trusted IP ranges to shrink exposure (trade-off: breaks public self-service if that is intended), and ensure the database account used by the app has least-privilege rights so a successful injection cannot reach unrelated schemas (trade-off: none significant). Consult the VulDB advisory (https://vuldb.com/vuln/384930) and the TaintRadar writeup for the exact injection details when validating the fix.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today