CVE-2025-69935
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.
Risk Assessment
An attacker can manipulate financial reports, potentially leading to falsified revenue data and compromised financial integrity.
Recommendation
Implement date validation and use parameterized queries in report.php and revenue_report.php.
Other vulnerabilities in CodeAstro Membership Management System
See all- CVE-2025-69938Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.
- CVE-2025-69937Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.
- CVE-2025-69936Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.
- CVE-2025-69934Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.
- CVE-2025-69933Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.
- CVE-2025-69931Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1.
- CVE-2025-69930Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL injection in /print_membership_card.php via the id parameter. An attacker can exploit this flaw to execute unauthorized database queries.
- CVE-2026-36387Medium
A Remote Code Execution vulnerability was found in CODEASTRO Membership Management System v1.0 in /add_members.php. Improper file sanitization allows attackers to inject malicious files, leading to RCE.
Original NVD description (English source)
CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.