PT-2026-20466 · Codeastro · Codeastro Membership Management System

Published 2026-02-18 · Updated 2026-02-18 · CVE-2025-70149

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CodeAstro Membership Management System version 1.0

Description The CodeAstro Membership Management System is affected by a SQL Injection issue. This issue is present in the print membership card.php file and occurs due to insufficient input validation of the ID parameter. Successful exploitation could allow an attacker to manipulate database queries. The API endpoint involved is print membership card.php. The vulnerable parameter is ID.

Recommendations Apply input validation and sanitization to the ID parameter in the print membership card.php file.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-70149

Affected Products

Codeastro Membership Management System

References · 6

• 🔥 https://youngkevinn.github.io/posts/CVE-2025-70149-Membership-SQLi · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-70149 · Security Note
• https://osv.dev/vulnerability/CVE-2025-70149 · Vendor Advisory
• https://twitter.com/TheHackerWire/status/2024206437082419362 · Twitter Post
• https://phpscriptsonline.com/product/membership-management-software · Note
• https://twitter.com/CVEnew/status/2024258102355513732 · Twitter Post