EUVD-2025-210555
GHSA-4xgr-67r9-5m98
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated, network-reachable, low-complexity SQL injection in a reporting endpoint grants full database read/write, so PR:N, AC:L and high C/I/A.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.
AnalysisAI
SQL injection in CodeAstro Membership Management System 1.0 lets remote attackers manipulate backend database queries through the unsanitized fromDate parameter in report.php and revenue_report.php. With no public exploit identified at time of analysis and a very low EPSS score (0.14%), the flaw carries a maximal CVSS 9.8 but appears to affect a niche PHP application; authentication requirements not confirmed beyond the PR:N stated in the CVSS vector, which indicates unauthenticated access. Successful exploitation permits full read/write access to membership and financial data.
Technical ContextAI
The affected software is CodeAstro Membership Management System, a PHP-based web application for managing member records and revenue reporting. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where the fromDate request parameter is concatenated directly into SQL queries within the reporting endpoints report.php and revenue_report.php without parameterization or input validation. Because these are date-filter inputs on reporting pages, they are typically passed into WHERE clauses, giving an attacker a direct injection point. The CPE string provided (cpe:2.3:a:n/a:n/a:*) is a placeholder with vendor and product marked 'n/a', so exact affected-product matching must rely on the description rather than structured NVD CPE data.
RemediationAI
No vendor-released patch identified at time of analysis for CodeAstro Membership Management System 1.0. Because a fix version is unavailable, apply compensating controls: rewrite the affected report.php and revenue_report.php queries to use parameterized/prepared statements (PDO or mysqli bound parameters) for the fromDate value, which is the definitive fix if you can edit the source; failing that, add server-side input validation to reject any fromDate value not matching a strict date format (e.g., YYYY-MM-DD), noting this must cover both endpoints. As an interim network control, place a WAF rule in front of report.php and revenue_report.php to block SQL metacharacters in the fromDate parameter (trade-off: WAF signatures can be bypassed and may cause false positives on legitimate date filters), and restrict access to the reporting endpoints to authenticated administrative users or trusted IP ranges (trade-off: reduces convenience for legitimate remote reporting). Consult the TaintRadar write-up (https://github.com/um-dsp/TaintRadar) and VulDB entry (https://vuldb.com/vuln/384932) for exploitation specifics when validating fixes.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today