CVE-2025-70149
SQL Injection in CodeAstro 1.0 print_membership_card.php
Publication date: 2026-02-18
Last updated on: 2026-02-23
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| codeastro | membership_management_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2025-70149 is a critical SQL Injection vulnerability in CodeAstro Membership Management System 1.0, specifically in the print_membership_card.php endpoint. This vulnerability arises because the application accepts a user-controlled 'id' parameter via HTTP GET requests without any authentication, validation, or use of prepared statements."}, {'type': 'paragraph', 'content': "The vulnerable code directly inserts the 'id' parameter into an SQL query without sanitization or casting it to an integer, allowing attackers to inject arbitrary SQL code. This enables blind or union-based SQL injection attacks remotely and without authentication."}, {'type': 'paragraph', 'content': "Attackers can manipulate the 'id' parameter to alter query logic, extract sensitive data such as email addresses and passwords, or perform other malicious database operations."}] [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing the print_membership_card.php endpoint with specially crafted HTTP GET requests targeting the id parameter to check for SQL Injection behavior.'}, {'type': 'paragraph', 'content': 'For example, you can send requests with boolean-based payloads to observe differences in response behavior or union-based payloads to attempt data extraction.'}, {'type': 'paragraph', 'content': 'A simple command using curl to test for boolean-based SQL Injection might be:'}, {'type': 'list_item', 'content': 'curl "http://targetsite/print_membership_card.php?id=1 AND 1=1"'}, {'type': 'list_item', 'content': 'curl "http://targetsite/print_membership_card.php?id=1 AND 1=2"'}, {'type': 'paragraph', 'content': 'If the responses differ significantly, it indicates a possible SQL Injection vulnerability.'}, {'type': 'paragraph', 'content': 'More advanced union-based tests can be crafted to extract data, but require careful construction of the SQL payload.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Use prepared statements (parameterized queries) for all SQL inputs, especially the id parameter.
- Strictly validate and cast the id parameter to an integer before using it in SQL queries.
- Enforce authentication and authorization on the print_membership_card.php endpoint if it should not be publicly accessible.
- Apply least-privilege principles to the database user to limit potential damage in case of exploitation.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including:
- Extraction of sensitive data such as credentials and personally identifiable information (PII).
- Modification or deletion of database records if the database user has write privileges.
- Performance degradation or denial of service through expensive time-based queries.
The actual impact depends on the database privileges assigned to the application’s database user, but the vulnerability has a critical severity score of 9.8, indicating high impact on confidentiality, integrity, and availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know