PT-2026-20465 · Unknown · Codeastro Membership Management System

Published 2026-02-18 · Updated 2026-02-24 · CVE-2025-70148

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions CodeAstro Membership Management System version 1.0

Description The application lacks proper authentication and authorization in the print membership card.php file. This allows unauthenticated attackers to access membership card data belonging to any user by directly requesting the file with a manipulated id parameter. This results in an insecure direct object reference (IDOR).

Recommendations Implement proper authentication and authorization checks in the print membership card.php file to ensure that only authorized users can access membership card data. Validate the id parameter to prevent direct object reference vulnerabilities.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-70148

Affected Products

Codeastro Membership Management System

References · 8

• 🔥 https://youngkevinn.github.io/posts/CVE-2025-70148-Membership-IDOR · Exploit
• https://osv.dev/vulnerability/CVE-2025-70148 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-70148 · Security Note
• https://twitter.com/CVEnew/status/2026265088244461845 · Twitter Post
• https://t.me/cveNotify/152465 · Telegram Post
• https://t.me/cveNotify/152578 · Telegram Post
• https://phpscriptsonline.com/product/membership-management-software · Note
• https://twitter.com/infoflowcloud/status/2026266594112835780 · Twitter Post